Arbitrary Node Title Disclosure Vulnerability in MultiLink Module for Drupal

CVE-2012-5589 · LOW Severity

AV:N/AC:M/AU:S/C:P/I:N/A:N

The MultiLink module 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal does not properly check node permissions when generating an in-content link, which allows remote authenticated users with text-editing permissions to read arbitrary node titles via a generated link.

Learn more about our User Device Pen Test.