Description
The MultiLink module 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal does not properly check node permissions when generating an in-content link, which allows remote authenticated users with text-editing permissions to read arbitrary node titles via a generated link.
References (4)
Core 4
Core References
Patch x_refsource_confirm
http://drupal.org/node/1289294
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/11/29/2
Patch, Vendor Advisory x_refsource_misc
http://drupal.org/node/1853244
Patch x_refsource_confirm
http://drupal.org/node/1289292
Scores
EPSS
0.0096
EPSS Percentile
57.4%
Details
CWE
CWE-200
Status
published
Products (8)
netgenius/multilink
6.x-2.0
netgenius/multilink
6.x-2.1
netgenius/multilink
6.x-2.2
netgenius/multilink
6.x-2.3
netgenius/multilink
6.x-2.4
netgenius/multilink
6.x-2.5
netgenius/multilink
6.x-2.6
netgenius/multilink
7.x-2.x dev
Published
Dec 26, 2012
Tracked Since
Feb 18, 2026