CVE-2007-0506

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-01-26 · updated 2026-06-16

Description

The project_issue_access function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access control modules and obtain attached files by guessing the filename, and obtain issue information via direct requests.

Affected products

Drupal Project: 4.6, 4.6_1.1, 4.7, 4.7_1.1, 4.7_2.1, 5.0
Drupal Project Issue Tracking Module: 4.7, 4.7_1.1, 4.7_2.1, 5.0

References

http://drupal.org/node/112146
http://osvdb.org/32135
http://secunia.com/advisories/23887
http://www.securityfocus.com/bid/22224
http://www.vupen.com/english/advisories/2007/0312
https://exchange.xforce.ibmcloud.com/vulnerabilities/31727
http://drupal.org/node/112146
http://osvdb.org/32135
http://secunia.com/advisories/23887
http://www.securityfocus.com/bid/22224
http://www.vupen.com/english/advisories/2007/0312
https://exchange.xforce.ibmcloud.com/vulnerabilities/31727

Get alerted when CVE-2007-0506 or the next vulnerability affects your stack