Servers and applications
CVE-2008-1729
The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to (1) edit the profile pages of arbitrary users, and obtain sensitive information from (2) tracker and (3) blog pages, related to a missing check for the "access content" permission; and (4) allows remote authenticated users, with administration page view access, to edit content types.
- Severity
- Medium 5.8
- Published
- 11 Apr 2008
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 6.2
- Exploit chance
- 2.4% in the next 30 daysHigher than 84% of CVEs. EPSS by FIRST, 12 Nov 2026
- Attack
- Over the network · No login needed
- Attacker can
- Read some data · Change some data
- CVSS vector
AV:N/AC:M/Au:N/C:P/I:P/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
DrupalServers and applications · cpe:a:drupal:drupal |
|