Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
By Drupal Security Team on
- Advisory ID: DRUPAL-SA-CONTRIB-2010-026
- Project: Monthly Archive by Node Type (third-party module)
- Version: 6.x (all branches)
- Date: 2010-March-10
- Security risk: Less Critical
- Exploitable from: Remote
- Vulnerability: Access Bypass
Description
The Monthly Archive by Node Type module generates monthly archive pages and a block with links to the pages. You can specify the node types that will be included in the archive pages. In some summary listings, the Monthly Archive by Node Type module does not construct its SQL query to respect node access restrictions, thus users can see listings of nodes which are restricted by a node access module and which should not be accessible.
Versions affected
- Monthly Archive by Node Type module for Drupal 6.x versions prior to 6.x-1.4, 6.x-2.7, or 6.x-3.3
Drupal core is not affected. If you do not use the contributed Monthly Archive by Node Type module, there is nothing you need to do.
Solution
Install the latest version.
- If you use the Monthly Archive by Node Type module for Drupal 6.x-1.x upgrade to Monthly Archive by Node Type 6.x-1.4
- If you use the Monthly Archive by Node Type module for Drupal 6.x-2.x upgrade to Monthly Archive by Node Type 6.x-2.7
- If you use the Monthly Archive by Node Type module for Drupal 6.x-3.x upgrade to Monthly Archive by Node Type 6.x-3.3
Reported by
- Prometheus6, the module maintainer.
Fixed by
- Prometheus6, the module maintainer.
Contact
The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.
