Description
Drupal 7.x before 7.3 allows remote attackers to bypass intended node_access restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 7.0, < 7.3 | 7.3 | GHSA-96vx-qf28-6f8m |
References
- FEDORA-2011-8879 vendor-advisory
- 45081 third-party-advisory
- 48505 vdb-entry
- FEDORA-2011-8878 vendor-advisory
- http://drupal.org/node/1204582
- [oss-security] 20110712 Re: CVE Request -- Drupal 7 -- Access bypass in node listings (SA-CORE-2011-002) mailing-list
- [oss-security] 20110711 CVE Request -- Drupal 7 -- Access bypass in node listings (SA-CORE-2011-002) mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=633385
- https://bugzilla.redhat.com/show_bug.cgi?id=717874
- 45291 third-party-advisory