Unscored severity · published Aug 20, 2007
CVE-2007-4436
The Drupal Project module before 5.x-1.0, 4.7.x-2.3, and 4.7.x-1.3 and Project issue tracking module before 5.x-1.0, 4.7.x-2.4, and 4.7.x-1.4 do not properly enforce permissions,…
–
CVSS
1.3%
EPSS
No
On KEV
Description
The Drupal Project module before 5.x-1.0, 4.7.x-2.3, and 4.7.x-1.3 and Project issue tracking module before 5.x-1.0, 4.7.x-2.4, and 4.7.x-1.4 do not properly enforce permissions, which allows remote attackers to (1) obtain sensitive via the Tracker Module and the Recent posts page; (2) obtain project names via unspecified vectors; (3) obtain sensitive information via the statistics pages; and (4) read CVS project activity.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Project · Drupal
through 4.7_1.1; through 4.7_2.1; through 5.0 · source: NVD
PI
Project Issue Tracking Module · Drupal
through 4.7_1.1; through 4.7_2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-4436
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-4436
Patch
http://drupal.org/node/168760
osvdb.org
http://osvdb.org/39632
Patch
http://secunia.com/advisories/26510
www.securityfocus.com
http://www.securityfocus.com/bid/25364
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/36105
More from Project
–
CVE-2007-0534
Multiple cross-site scripting (XSS) vulnerabilities in the (1) Project issue tracking 4.7.0 through 5.x before 20070123 and (2) Project 4.6.0 through 5.x before 20070123 modules…
–
CVE-2007-0505
Unrestricted file upload vulnerability in the Project issue tracking 4.7.0 through 5.x before 20070123, a module for Drupal, allows remote authenticated users to execute arbitrary…
–
CVE-2007-0506
The project_issue_access function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access…