CVE-2007-5597: Medium severity Drupal Drupal vulnerability
Published Oct 19, 2007
·Updated
The hookcomments API in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 does not pass publication status, which might allow attackers to bypass access restrictions and trigger e-mail with unpublished comments from some modules, as demonstrated by (1) Organic groups and (2) Subscriptions.
Affected Software
2 affected components
Drupal Drupal>=4.7.0<4.7.8
Drupal Drupal>=5.0<5.3
Event History
Oct 19, 2007
CVE Published
11:17 PM
Oct 20, 2007
CVE Published
via MITRE·03:00 AM
Data Sourced
via MITRE·03:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-5597?
CVE-2007-5597 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2007-5597?
To mitigate CVE-2007-5597, update Drupal to version 4.7.8 or 5.3 or later.
3
What systems are affected by CVE-2007-5597?
CVE-2007-5597 affects Drupal versions 4.7.x prior to 4.7.8 and 5.x prior to 5.3.
4
What does CVE-2007-5597 allow attackers to do?
CVE-2007-5597 allows attackers to bypass access restrictions and trigger emails with unpublished comments.
5
Which modules are specifically mentioned in connection with CVE-2007-5597?
Organic groups and Subscriptions modules are specifically mentioned in relation to CVE-2007-5597.