ID |
CVE-2007-1368
|
Summary |
The Project issue tracking module before 4.7.x-1.3, 4.7.x-2.* before 4.7.x-2.3, and 5 before 5.x-0.2-beta for Drupal allows remote authenticated users, with "access project issues" permission, to read the contents of a private node via a URL with a modified node identifier. |
References |
|
Vulnerable Configurations |
-
cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_1.0:*:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_1.0:*:*:*:*:*:*:*
-
cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_1.2:*:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_1.2:*:*:*:*:*:*:*
-
cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_2.0:*:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_2.0:*:*:*:*:*:*:*
-
cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_2.1:*:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_2.1:*:*:*:*:*:*:*
-
cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_2.2:*:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal_project_issue_tracking:4.7_2.2:*:*:*:*:*:*:*
-
cpe:2.3:a:drupal:drupal_project_issue_tracking:5.0_0.1:*:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal_project_issue_tracking:5.0_0.1:*:*:*:*:*:*:*
-
cpe:2.3:a:drupal:drupal_project_issue_tracking:5.7_1.1:*:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal_project_issue_tracking:5.7_1.1:*:*:*:*:*:*:*
|
CVSS |
Base: | 3.5 (as of 29-07-2017 - 01:30) |
Impact: | |
Exploitability: | |
|
CWE |
NVD-CWE-Other |
CAPEC |
|
Access |
Vector | Complexity | Authentication |
NETWORK |
MEDIUM |
SINGLE |
|
Impact |
Confidentiality | Integrity | Availability |
PARTIAL |
NONE |
NONE |
|
cvss-vector
via4
|
AV:N/AC:M/Au:S/C:P/I:N/A:N
|
refmap
via4
|
bid | 22867 | confirm | | osvdb | 33913 | secunia | 24409 | vupen | ADV-2007-0873 | xf | projectissuetracking-node-security-bypass(32871) |
|
Last major update |
29-07-2017 - 01:30 |
Published |
09-03-2007 - 22:19 |
Last modified |
29-07-2017 - 01:30 |