CVE-2007-0506 The project_issue_access function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access control modules and obtain....
MediumCVSS 6.0
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The project_issue_access function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access control modules and obtain attached files by guessing the filename, and obtain issue information via direct requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal project | = 4.6 | No fix listed |
| drupal project | = 4.6_1.1 | No fix listed |
| drupal project | = 4.7 | No fix listed |
| drupal project | = 4.7_1.1 | No fix listed |
| drupal project | = 4.7_2.1 | No fix listed |
| drupal project | = 5.0 | No fix listed |
| drupal project issue tracking module | = 4.7 | No fix listed |
| drupal project issue tracking module | = 4.7_1.1 | No fix listed |
| drupal project issue tracking module | = 4.7_2.1 | No fix listed |
| drupal project issue tracking module | = 5.0 | No fix listed |
References
- drupal.org patch vendor-advisory
- 32135 vdb-entry
- 23887 third-party-advisory
- 22224 vdb-entry
- ADV-2007-0312 vdb-entry
- projecttracking-access-info-disclosure(31727) vdb-entry