CVE-2008-4792
Published Oct 29, 2008
Last updated 6 years ago
Overview
- Description
- The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values.
- Source
- cve@mitre.org
- NVD status
- Analyzed
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 6
- Impact score
- 6.4
- Exploitability score
- 6.8
- Vector string
- AV:N/AC:M/Au:S/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-264
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "670C8A78-8D5A-40B9-8295-CAF87F804BC2",
"versionEndExcluding": "5.11",
"versionStartIncluding": "5.0"
},
{
"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "22BC2E4E-91B7-4D16-9B29-74695FAAF19C",
"versionEndExcluding": "6.5",
"versionStartIncluding": "6.0"
}
],
"operator": "OR"
}
]
}
]