CVE-2007-5597 Missing authorization in n/a
Attackers can bypass access restrictions to trigger emails for unpublished comments in Drupal modules like Organic Groups and Subscriptions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2007-5597?
CVE-2007-5597 is a medium-severity missing authorization vulnerability in Drupal Drupal, published on 19 Oct 2007. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The hook_comments API in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 does not pass publication status, which might allow attackers to bypass access restrictions and trigger e-mail with unpublished comments from some modules, as demonstrated by (1) Organic groups and (2) Subscriptions.
Weakness: CWE-264
Which versions are affected by CVE-2007-5597?
It affects 1 product.
Products include Drupal Drupal.
How do I fix CVE-2007-5597?
No fix has been published for CVE-2007-5597 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2007-5597 being exploited?
There is no known exploitation of CVE-2007-5597 in the wild and no public exploit code.
Other vulnerabilities in Drupal Drupal
Sources
Also known as GHSA-8j8f-9c88-qr6w.