The menu system routes page requests to appropriate handlers. It also determines whether a user had access to pages based on several criteria, such as permissions assigned to a role. Drupal 6 features an entirely revised menu system, including changes to the way access was dealt with, which if not properly understood by developers could lead to vulnerabilities. This security release provides a more secure access behaviour by default, and fixes incorrectly set menu items in Drupal core.
Access to some pages was not appropriately controlled:
– Any user could edit profile pages of other users.
– Users who could view administration pages were able to edit content types.
– The tracker and blog pages expose information to users without the “access content” permission.
Part of security release SA-2008-026
This vulnerability affects the following application versions:
- Drupal 6.0
- Drupal 6.1