CVE-2007-5597

Drupal 4.7.0-4.7.7 - Access Restriction Bypass via hook_comments API

Title source: llm

Description

The hook_comments API in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 does not pass publication status, which might allow attackers to bypass access restrictions and trigger e-mail with unpublished comments from some modules, as demonstrated by (1) Organic groups and (2) Subscriptions.

References (7)

Core 7

Core References

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2007/3546

Vendor Advisory x_refsource_confirm

http://drupal.org/node/184354

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/37296

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/27292

Third Party Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00328.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/27352

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/26119

Scores

EPSS 0.0055

EPSS Percentile 68.2%

Details

CWE

CWE-264

Status published

Products (1)

drupal/drupal 4.7.0 - 4.7.8

Published Oct 19, 2007

Tracked Since Feb 18, 2026