Description
The Node Parameter Control module 6.x-1.x for Drupal does not properly restrict access to the configuration options, which allows remote attackers to read and edit configuration options via unspecified vectors.
References
- 91257 vdb-entry
- http://drupal.org/node/1942330
- http://packetstormsecurity.com/files/120788/Drupal-Node-Parameter-Control-6.x-Access-Bypass.html
- [oss-security] 20130314 Re: CVE request for a Drupal contributed module mailing-list
- 20130313 [Security-news] SA-CONTRIB-2013-034 - Node Parameter Control - Access Bypass mailing-list