CVE-2009-2077

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-06-16 · updated 2026-06-16
Weakness: CWE-264

Description

Drupal 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to bypass access restrictions and (1) read unpublished content from anonymous users when a view is already configured to display the content, and (2) read private content in generated queries.

Affected products

Angrydonuts Views: 6.x-2.0, 6.x-2.0-alpha1, 6.x-2.0-alpha2, 6.x-2.0-alpha3, 6.x-2.0-alpha4, 6.x-2.0-alpha5 (+15)

References

http://drupal.org/node/488068
http://drupal.org/node/488082
http://secunia.com/advisories/35425
http://www.securityfocus.com/bid/35304
http://drupal.org/node/488068
http://drupal.org/node/488082
http://secunia.com/advisories/35425
http://www.securityfocus.com/bid/35304

Get alerted when CVE-2009-2077 or the next vulnerability affects your stack