CVE-2008-4792

MediumCVSS 6.0/10Last modified Jun 16, 2026

Description

The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values.

Metrics

CVSS 2.0 6.0/10AV:N/AC:M/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://drupal.org/node/318706Patch, Vendor Advisory
http://secunia.com/advisories/32201Third Party Advisory
http://www.openwall.com/lists/oss-security/2008/10/21/7Mailing List, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/45761Third Party Advisory, VDB Entry
http://drupal.org/node/318706Patch, Vendor Advisory
http://secunia.com/advisories/32201Third Party Advisory
http://www.openwall.com/lists/oss-security/2008/10/21/7Mailing List, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/45761Third Party Advisory, VDB Entry

Timeline

Published: Oct 29, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008