Description
The Node Reference module in Content Construction Kit (CCK) module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes.
References
- 65615 vdb-entry
- 40243 third-party-advisory
- http://drupal.org/node/829566
- FEDORA-2010-10127 vendor-advisory
- FEDORA-2010-10200 vendor-advisory
- ADV-2010-1546 vdb-entry
- 40318 third-party-advisory
- FEDORA-2010-10176 vendor-advisory
- cck-noderef-info-disc(59515) vdb-entry