The menu system routes page requests to appropriate handlers. It also determines whether a user has access to pages based on several criteria, such as permissions assigned to a role.
Credit:
The information has been provided by Peter Wolanin and Greg Knaddison.
Vulnerable Systems:
* Drupal 6.x before version 6.2.
The menu system routes page requests to appropriate handlers. It also determines whether a user has access to pages based on several criteria, such as permissions assigned to a role. Drupal 6 features an entirely revised menu system, including changes to the way access is dealt with, which if not properly understood by developers can lead to vulnerabilities. This security release provides a more secure access behaviour by default, and fixes incorrectly set menu items in Drupal core.
Access to some pages was not appropriately controlled:
Any user can edit profile pages of other users.
Users who can view administration pages are able to edit content types.
The tracker and blog pages expose information to users without the "access content" permission.
Vendor Status:
Drupal issued an update for this vulnerability
