CVE-2008-1729

Severity: medium (CVSS 5.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-04-11 · updated 2026-06-16

Description

The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to (1) edit the profile pages of arbitrary users, and obtain sensitive information from (2) tracker and (3) blog pages, related to a missing check for the "access content" permission; and (4) allows remote authenticated users, with administration page view access, to edit content types.

Affected products

Drupal: from 6.0 before 6.2 — fixed in 6.2

How to fix

Upgrade to a fixed version: Drupal 6.2. Check the vendor advisory for mitigations.

References

http://drupal.org/node/244637
http://secunia.com/advisories/29762
http://www.osvdb.org/44270
http://www.securityfocus.com/bid/28714
http://www.vupen.com/english/advisories/2008/1185/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/41755
http://drupal.org/node/244637
http://secunia.com/advisories/29762
http://www.osvdb.org/44270
http://www.securityfocus.com/bid/28714
http://www.vupen.com/english/advisories/2008/1185/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/41755

Get alerted when CVE-2008-1729 or the next vulnerability affects your stack