CVE-2008-1729

Description

The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to (1) edit the profile pages of arbitrary users, and obtain sensitive information from (2) tracker and (3) blog pages, related to a missing check for the access content permission; and (4) allows remote authenticated users, with administration page view access, to edit content types.

Risk Information

Base Score

4.3

MODERATE

Vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS Score

Exploitation Probability

0.618

Associated Vulnerability

Vulnerability	OS Platform
Update drupal 6.1 to latest version	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234