CVE-2012-5589 Information

Description

The MultiLink module 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal does not properly check node permissions when generating an in-content link which allows remote authenticated users with text-editing permissions to read arbitrary node titles via a generated link.

Reference

http://drupal.org/node/1289292 http://drupal.org/node/1289294 http://drupal.org/node/1853244 http://www.openwall.com/lists/oss-security/2012/11/29/2