Scoutnet vzw

------------NODEFAMILY - ACCESS BYPASS------------

* Advisory ID: DRUPAL-SA-2007-011
* Project: Node familty (third-party module)
* Version: 5.x
* Date: 2007-March-6
* Security risk: Less critical
* Exploitable from: Remote
* Vulnerability: Access bypass

------------DESCRIPTION------------

Nodefamily is needed for building user profiles with the nodeprofile module. By manipulating URL arguments, authenticated users are able to access and modify the profile of other users.

------------VERSIONS AFFECTED------------

* Nodefamily for Drupal 5.x before 5.x-1.0

Nodefamily for 4.7.x is not affected.

Drupal core is not affected. If you do not use the contributed Nodefamily module, there is nothing you need to do.

------------SOLUTION------------

Install the latest version:

* Node family 5.x-1.0 [http://drupal.org/node/123126].

See also the Nodefamily project page [http://drupal.org/project/nodefamily].

------------REPORTED BY------------

Ryan C.

------------CONTACT------------

The security contact for Drupal can be reached at security at drupal.org or via the form at [http://drupal.org/contact].