Unscored severity · published Jan 26, 2007
CVE-2007-0506
The project_issue_access function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access…
–
CVSS
1.2%
EPSS
No
On KEV
Description
The project_issue_access function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access control modules and obtain attached files by guessing the filename, and obtain issue information via direct requests.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Project · Drupal
4.6; 4.6_1.1; 4.7; 4.7_1.1; 4.7_2.1; 5.0 · source: NVD
PI
Project Issue Tracking Module · Drupal
4.7; 4.7_1.1; 4.7_2.1; 5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0506
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-0506
Patch
http://drupal.org/node/112146
osvdb.org
http://osvdb.org/32135
secunia.com
http://secunia.com/advisories/23887
www.securityfocus.com
http://www.securityfocus.com/bid/22224
www.vupen.com
http://www.vupen.com/english/advisories/2007/0312
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/31727
More from Project
–
CVE-2007-4436
The Drupal Project module before 5.x-1.0, 4.7.x-2.3, and 4.7.x-1.3 and Project issue tracking module before 5.x-1.0, 4.7.x-2.4, and 4.7.x-1.4 do not properly enforce permissions,…
–
CVE-2007-0534
Multiple cross-site scripting (XSS) vulnerabilities in the (1) Project issue tracking 4.7.0 through 5.x before 20070123 and (2) Project 4.6.0 through 5.x before 20070123 modules…
–
CVE-2007-0505
Unrestricted file upload vulnerability in the Project issue tracking 4.7.0 through 5.x before 20070123, a module for Drupal, allows remote authenticated users to execute arbitrary…