The vulnerability specifically affects Drupal 6's Blog API module implementation of XML-RPC methods. The security advisory explicitly states Drupal 6 core was vulnerable via blogapi module methods. The blogapi_blogger_get_user_info is a known authentication method handler that lacked flood control. The core xmlrpc system's ability to process multiple simultaneous calls to the same method (via hook_xmlrpc implementations) created the amplification vector. While exact code isn't shown, Drupal's architecture requires XML-RPC methods to be registered via hook_xmlrpc, and the blogapi module was specifically called out as vulnerable in the CVE description.