Unscored severity · published Apr 11, 2008
CVE-2008-1729
The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to (1) edit the profile pages of arbitrary users, and obtain sensitive…
–
CVSS
2.4%
EPSS
No
On KEV
Description
The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to (1) edit the profile pages of arbitrary users, and obtain sensitive information from (2) tracker and (3) blog pages, related to a missing check for the "access content" permission; and (4) allows remote authenticated users, with administration page view access, to edit content types.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Drupal · Drupal
6.0 before 6.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1729
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1729
Patch
http://drupal.org/node/244637
Third Party Advisory
http://secunia.com/advisories/29762
Broken Link
http://www.osvdb.org/44270
Patch
http://www.securityfocus.com/bid/28714
Third Party Advisory
http://www.vupen.com/english/advisories/2008/1185/references
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/41755
More from Drupal
9.8
CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
9.8
CVE-2018-7602
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
9.8
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
8.8
CVE-2020-13671
Drupal core Un-restricted Upload of File
8.1
CVE-2019-6340
Drupal core - Highly critical - Remote Code Execution