Description

The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page.

Remediation

References

CVE-2014-1476

Related Vulnerabilities

Ruby Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2019-16254)

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-27634)

WordPress Plugin Simple Contact Info Arbitrary File Deletion (1.1.9)

Django Improper Input Validation Vulnerability (CVE-2011-4138)

ProjectSend Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-0607)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2014-1476