Description

The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values.

Remediation

References

CVE-2008-4792

Related Vulnerabilities

Chamilo Improper Privilege Management Vulnerability (CVE-2026-33706)

Oracle HTTP Server Use of Insufficiently Random Values Vulnerability (CVE-2020-35163)

Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-1000362)

XWikiplatform Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2024-37900)

WordPress Plugin WP-Footnotes 'admin_panel.php' Multiple Remote Vulnerabilities (2.2)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2008-4792