VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 20, 2007· Updated Jun 16, 2026

CVE-2007-4436

CVE-2007-4436

Description

The Drupal Project module before 5.x-1.0, 4.7.x-2.3, and 4.7.x-1.3 and Project issue tracking module before 5.x-1.0, 4.7.x-2.4, and 4.7.x-1.4 do not properly enforce permissions, which allows remote attackers to (1) obtain sensitive via the Tracker Module and the Recent posts page; (2) obtain project names via unspecified vectors; (3) obtain sensitive information via the statistics pages; and (4) read CVS project activity.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Drupal/Project
    cpe:2.3:a:drupal:project:*:*:*:*:*:*:*:*
    Range: <=4.7_1.1
  • Drupal/Project Issue Tracking Module2 versions
    cpe:2.3:a:drupal:project_issue_tracking_module:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:drupal:project_issue_tracking_module:*:*:*:*:*:*:*:*range: <=4.7_1.1
    • (no CPE)range: before 5.x-1.0, 4.7.x-2.4, and 4.7.x-1.4
  • Drupal/project modulellm-fuzzy
    Range: before 5.x-1.0, 4.7.x-2.3, and 4.7.x-1.3

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.