Description

Drupal 7.x before 7.3 allows remote attackers to bypass intended node_access restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table.

Remediation

References

CVE-2011-2687

Related Vulnerabilities

WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar Cross-Site Scripting (3.0.1)

WordPress Plugin Site Editor-WordPress Site Builder-Theme Builder and Page Builder Local File Inclusion (1.1.1)

WordPress 4.4.x Multiple Vulnerabilities (4.4 - 4.4.28)

WordPress Plugin NEX-Forms Lite-WordPress Contact Form builder Cross-Site Scripting (2.1.0)

WordPress Plugin FileBird-WordPress Media Library Folders & File Manager SQL Injection (4.7.3)

Severity

High

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2011-2687