Description

The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values.

Remediation

References

CVE-2008-4792

Related Vulnerabilities

WordPress Plugin Form Builder-Create Responsive Contact Forms Cross-Site Scripting (1.9.8.3)

PleskWin Exposure of Resource to Wrong Sphere Vulnerability (CVE-2023-43784)

WordPress Plugin Photo Gallery, Images, Slider in Rbs Image Gallery Unspecified Vulnerability (2.0.18)

Sqlite Uncontrolled Recursion Vulnerability (CVE-2019-19645)

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark SQL Injection (2.8.6)

Severity

Medium

Classification

CVE-2008-4792 CWE-264

Tags

Missing Update Known Vulnerabilities