CVE-2007-0506

Drupal Project Issue Tracking Module 4.7.0-5.x - Authenticated Access Control Bypass via Filename Guessing

Title source: llm
STIX 2.1

Description

The project_issue_access function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access control modules and obtain attached files by guessing the filename, and obtain issue information via direct requests.

References (6)

Core 6
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23887
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/22224
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/32135
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/0312
Patch, Vendor Advisory x_refsource_confirm
http://drupal.org/node/112146
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/31727

Scores

EPSS 0.0047
EPSS Percentile 64.8%

Details

Status published
Products (10)
drupal/project 4.6
drupal/project 4.6_1.1
drupal/project 4.7
drupal/project 4.7_1.1
drupal/project 4.7_2.1
drupal/project 5.0
drupal/project_issue_tracking_module 4.7
drupal/project_issue_tracking_module 4.7_1.1
drupal/project_issue_tracking_module 4.7_2.1
drupal/project_issue_tracking_module 5.0
Published Jan 26, 2007
Tracked Since Feb 18, 2026