CVE-2005-3974

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-12-03 · updated 2026-06-16

Description

Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission.

Affected products

Drupal: 4.5, 4.5.1, 4.5.2, 4.5.3, 4.5.4, 4.5.5 (+4)

References

http://drupal.org/files/sa-2005-009/4.6.3.patch
http://drupal.org/files/sa-2005-009/advisory.txt
http://secunia.com/advisories/17824
http://secunia.com/advisories/18630
http://www.debian.org/security/2006/dsa-958
http://www.securityfocus.com/archive/1/418336/100/0/threaded
http://www.securityfocus.com/bid/15674
http://www.vupen.com/english/advisories/2005/2684
http://drupal.org/files/sa-2005-009/4.6.3.patch
http://drupal.org/files/sa-2005-009/advisory.txt
http://secunia.com/advisories/17824
http://secunia.com/advisories/18630

Get alerted when CVE-2005-3974 or the next vulnerability affects your stack