CVE-2010-3093

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-09-21 · updated 2026-06-16
Weakness: CWE-264

Description

The comment module in Drupal 5.x before 5.23 and 6.x before 6.18 allows remote authenticated users with certain privileges to bypass intended access restrictions and reinstate removed comments via a crafted URL, related to an "unpublishing bypass" issue.

Affected products

Drupal: 5.0, 5.0-beta1, 5.0-beta2, 5.0-dev, 5.0-rc1, 5.0-rc2 (+49)

References

http://drupal.org/node/880476
http://marc.info/?l=oss-security&m=128418560705305&w=2
http://marc.info/?l=oss-security&m=128440896914512&w=2
http://www.debian.org/security/2010/dsa-2113
http://www.securityfocus.com/bid/42391
http://drupal.org/node/880476
http://marc.info/?l=oss-security&m=128418560705305&w=2
http://marc.info/?l=oss-security&m=128440896914512&w=2
http://www.debian.org/security/2010/dsa-2113
http://www.securityfocus.com/bid/42391

Get alerted when CVE-2010-3093 or the next vulnerability affects your stack