A vulnerability has been reported in the SIOC (Semantically-Interconnected Online Communities) module for Drupal, which can be exploited by malicious people to bypass certain security restrictions and disclose sensitive information.

The vulnerability is caused due to improper access restriction. This can be exploited to display comments, hashed e-mail messages, usernames, and roles without valid user credentials.

The vulnerability is reported in all 5.x versions prior to 5.x-1.2 and all 6.x versions prior to 6.x-1.1.

Solution
Update to version 5.x-1.2 or 6.x-1.1.

Provided and/or discovered by
Stéphane Corlosquet and Peter Wolanin, Drupal security team

Changelog
Further details available to Secunia VIM customers

Original Advisory
DRUPAL-SA-2008-062:
http://drupal.org/node/318749

Deep Links
Links available to Secunia VIM customers