A vulnerability has been reported in the SIOC (Semantically-Interconnected Online Communities) module for Drupal, which can be exploited by malicious people to bypass certain security restrictions and disclose sensitive information.

The vulnerability is caused due to improper access restriction. This can be exploited to display comments, hashed e-mail messages, usernames, and roles without valid user credentials.

The vulnerability is reported in all 5.x versions prior to 5.x-1.2 and all 6.x versions prior to 6.x-1.1.

Solution
Update to version 5.x-1.2 or 6.x-1.1.

Provided and/or discovered by
Stéphane Corlosquet and Peter Wolanin, Drupal security team

Changelog
Further details available in Customer Area

Original Advisory
DRUPAL-SA-2008-062:
http://drupal.org/node/318749

Deep Links
Links available in Customer Area