A vulnerability has been identified in Monthly Archive by Node Type (module for Drupal), which could be exploited by attackers to bypass security restrictions. This issue is caused due to the module constructing SQL query without applying node access restrictions, which could allow users to view listings of nodes which are restricted by a node access module.

Affected Products

Monthly Archive by Node Type (module for Drupal) versions prior to 6.x-1.4
Monthly Archive by Node Type (module for Drupal) versions prior to 6.x-2.7
Monthly Archive by Node Type (module for Drupal) versions prior to 6.x-3.3

Solution

Upgrade to Monthly Archive by Node Type (module for Drupal) version 6.x-1.4, 6.x-2.7 or 6.x-3.3 :
http://drupal.org/project/montharchive

References

http://www.vupen.com/english/advisories/2010/0587
http://drupal.org/node/738434

Credits

Vulnerability reported by the vendor.

Changelog

2010-03-11 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.