CVE-2008-4792

The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values.

• CWE-264

• http://drupal.org/node/318706Patch, Vendor Advisory
• http://secunia.com/advisories/32201Third Party Advisory
• http://www.openwall.com/lists/oss-security/2008/10/21/7Mailing List, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45761Third Party Advisory, VDB Entry
• http://drupal.org/node/318706Patch, Vendor Advisory
• http://secunia.com/advisories/32201Third Party Advisory
• http://www.openwall.com/lists/oss-security/2008/10/21/7Mailing List, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45761Third Party Advisory, VDB Entry

Published

Oct 29, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-4786SQL injection vulnerability in easyshop.php in the EasyShop …
• CVE-2008-4787Visual truncation vulnerability in Microsoft Internet Explor…
• CVE-2008-4788Microsoft Internet Explorer 6 omits high-bit URL-encoded cha…
• CVE-2008-4789The validation functionality in the core upload module in Dr…
• CVE-2008-4790The core upload module in Drupal 5.x before 5.11 allows remo…
• CVE-2008-4791The user module in Drupal 5.x before 5.11 and 6.x before 6.5…
• CVE-2008-4793The node module API in Drupal 5.x before 5.11 allows remote …
• CVE-2008-4794Opera before 9.62 allows remote attackers to execute arbitra…
• CVE-2008-4795The links panel in Opera before 9.62 processes Javascript wi…
• CVE-2008-4796The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoo…
• CVE-2008-4797Directory traversal vulnerability in Arihiro Kurata Kantan W…
• CVE-2008-4798The loadModule function in lib/WebGUI/Asset.pm in WebGUI bef…