{"id":"CVE-2008-4792","aliases":["EUVD-2008-4772","GHSA-8q2j-8pc6-8c5r"],"status":"published","title":"The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate...","description":"The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values.","severity":{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01282,"percentile":0.7024,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2008-10-29T15:00:00Z","modified":"2026-06-16T22:58:32Z","products":[{"vendor":"drupal","product":"drupal"}],"references":[{"url":"http://drupal.org/node/318706","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://secunia.com/advisories/32201","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2008/10/21/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45761","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-4792"},{"url":"https://github.com/advisories/GHSA-8q2j-8pc6-8c5r"}],"sources":{"cve":[{"id":"CVE-2008-4792","description":"The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values.","status":"published","published":"2008-10-29T15:00:00Z","modified":"2024-08-07T10:31:27.511Z","updated_at":"2026-11-02T14:34:46.950176Z"}],"euvd":[{"id":"EUVD-2008-4772","description":"The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values.","status":"published","published":"2008-10-29T15:00:00Z","modified":"2024-08-07T10:31:27Z","updated_at":"2026-11-03T01:38:46.371749Z"}],"ghsa":[{"id":"GHSA-8q2j-8pc6-8c5r","title":"The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate...","description":"The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values.","status":"published","published":"2022-05-14T02:02:34Z","modified":"2023-02-02T05:04:46Z","updated_at":"2026-11-02T14:51:56.960601Z"}],"nvd":[{"id":"CVE-2008-4792","description":"The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values.","status":"published","published":"2008-10-29T15:31:35.573Z","modified":"2026-06-16T22:58:32.997Z","cvss":[{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:01:29.223028Z"}]}}