CVE-2010-0752

The week_post_page function in the Weekly Archive by Node Type module 6.x before 6.x-2.7 for Drupal does not properly implement node access restrictions when constructing SQL queries, which allows remote attackers to read restricted node listings via unspecified vectors.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2010-02-27

Last modified

2024-08-07

Weaknesses

CWE-264

Affected products

• Week (Earl Dunovant)

References

• http://drupal.org/node/723776
• http://drupal.org/node/724286
• http://osvdb.org/62565
• http://secunia.com/advisories/38717
• http://www.securityfocus.com/bid/38397
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56504