CVE:CVE-2007-0506
CNNVD:CNNVD-200701-440
Drupal项目事件追踪模块20070123之前的4.7.0到5.x版本中的project_issue_access函数允许远程认证用户通过猜测出文件名，来绕过其他的访问控制模块和获得附件；借助直接请求，获得事件信息。
solution:Upgrade drupal project to a higher version than 4.6,4.6_1.1,4.7,4.7_1.1,4.7_2.1,5.0,and avoid the version 4.6,4.6_1.1,4.7,4.7_1.1,4.7_2.1,5.0; Upgrade drupal project_issue_tracking_module to a higher version than 4.7,4.7_1.1,4.7_2.1,5.0,and avoid the version 4.7,4.7_1.1,4.7_2.1,5.0