Lucene search

[email protected]CVE-2007-0506

HistoryJan 26, 2007 - 12:28 a.m.

CVE-2007-0506

2007-01-2600:28:00

[email protected]

web.nvd.nist.gov

cve-2007-0506

drupal

project issue tracking

access control

file access

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

6.1 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.7%

JSON

The project_issue_access function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access control modules and obtain attached files by guessing the filename, and obtain issue information via direct requests.

Affected configurations

NVD

Node

drupalprojectMatch4.6

drupalprojectMatch4.6_1.1

drupalprojectMatch4.7

drupalprojectMatch4.7_1.1

drupalprojectMatch4.7_2.1

drupalprojectMatch5.0dev

drupalproject_issue_tracking_moduleMatch4.7

drupalproject_issue_tracking_moduleMatch4.7_1.1

drupalproject_issue_tracking_moduleMatch4.7_2.1

drupalproject_issue_tracking_moduleMatch5.0dev

CPENameOperatorVersion
drupal:projectdrupal projecteq4.6
drupal:projectdrupal projecteq4.6_1.1
drupal:projectdrupal projecteq4.7
drupal:projectdrupal projecteq4.7_1.1
drupal:projectdrupal projecteq4.7_2.1
drupal:projectdrupal projecteq5.0
drupal:project_issue_tracking_moduledrupal project issue tracking moduleeq4.7
drupal:project_issue_tracking_moduledrupal project issue tracking moduleeq4.7_1.1
drupal:project_issue_tracking_moduledrupal project issue tracking moduleeq4.7_2.1
drupal:project_issue_tracking_moduledrupal project issue tracking moduleeq5.0

CPE	Name	Operator	Version
drupal:project	drupal project	eq	4.6
drupal:project	drupal project	eq	4.6_1.1
drupal:project	drupal project	eq	4.7
drupal:project	drupal project	eq	4.7_1.1
drupal:project	drupal project	eq	4.7_2.1
drupal:project	drupal project	eq	5.0
drupal:project_issue_tracking_module	drupal project issue tracking module	eq	4.7
drupal:project_issue_tracking_module	drupal project issue tracking module	eq	4.7_1.1
drupal:project_issue_tracking_module	drupal project issue tracking module	eq	4.7_2.1
drupal:project_issue_tracking_module	drupal project issue tracking module	eq	5.0

References

drupal.org/node/112146

osvdb.org/32135

secunia.com/advisories/23887

www.securityfocus.com/bid/22224

www.vupen.com/english/advisories/2007/0312

exchange.xforce.ibmcloud.com/vulnerabilities/31727

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

6.1 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.7%

JSON

Related for CVE-2007-0506

prion1 nvd1 cvelist1 securityvulns1