CVE-2007-4436

2007-08-2022:17:00

CWE-264

[email protected]

web.nvd.nist.gov

cve

2007

4436

drupal

project module

issue tracking

permissions

sensitive information

remote attackers

6.2 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.008 Low

EPSS

Percentile

81.2%

JSON

The Drupal Project module before 5.x-1.0, 4.7.x-2.3, and 4.7.x-1.3 and Project issue tracking module before 5.x-1.0, 4.7.x-2.4, and 4.7.x-1.4 do not properly enforce permissions, which allows remote attackers to (1) obtain sensitive via the Tracker Module and the Recent posts page; (2) obtain project names via unspecified vectors; (3) obtain sensitive information via the statistics pages; and (4) read CVS project activity.

Affected configurations

NVD

Node

drupalprojectRange≤4.7_1.1

drupalprojectRange≤4.7_2.1

drupalprojectRange≤5.0

drupalproject_issue_tracking_moduleRange≤4.7_1.1

drupalproject_issue_tracking_moduleRange≤4.7_2.1

CPENameOperatorVersion
drupal:projectdrupal projectle4.7_1.1
drupal:projectdrupal projectle4.7_2.1
drupal:projectdrupal projectle5.0
drupal:project_issue_tracking_moduledrupal project issue tracking modulele4.7_1.1
drupal:project_issue_tracking_moduledrupal project issue tracking modulele4.7_2.1

CPE	Name	Operator	Version
drupal:project	drupal project	le	4.7_1.1
drupal:project	drupal project	le	4.7_2.1
drupal:project	drupal project	le	5.0
drupal:project_issue_tracking_module	drupal project issue tracking module	le	4.7_1.1
drupal:project_issue_tracking_module	drupal project issue tracking module	le	4.7_2.1