CVE-2012-5537

2022-10-0316:15:30

CWE-94

[email protected]

web.nvd.nist.gov

cve-2012-5537

simplenews

scheduler

drupal

remote code injection

cron

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

6.8 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

72.9%

JSON

The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the “send scheduled newsletters” permission to inject arbitrary PHP code into the scheduling form, which is later executed by cron.

Affected configurations

NVD

Node

simplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.0

simplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.0beta2

simplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.0beta3

simplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.0beta4

simplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.1

simplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.2

simplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.3

simplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.xdev

AND

drupaldrupalMatch-

CPENameOperatorVersion
simplenews_scheduler_project:simplenews_schedulersimplenews scheduler project simplenews schedulereq6.x-2.0
simplenews_scheduler_project:simplenews_schedulersimplenews scheduler project simplenews schedulereq6.x-2.1
simplenews_scheduler_project:simplenews_schedulersimplenews scheduler project simplenews schedulereq6.x-2.2
simplenews_scheduler_project:simplenews_schedulersimplenews scheduler project simplenews schedulereq6.x-2.3
simplenews_scheduler_project:simplenews_schedulersimplenews scheduler project simplenews schedulereq6.x-2.x

CPE	Name	Operator	Version
simplenews_scheduler_project:simplenews_scheduler	simplenews scheduler project simplenews scheduler	eq	6.x-2.0
simplenews_scheduler_project:simplenews_scheduler	simplenews scheduler project simplenews scheduler	eq	6.x-2.1
simplenews_scheduler_project:simplenews_scheduler	simplenews scheduler project simplenews scheduler	eq	6.x-2.2
simplenews_scheduler_project:simplenews_scheduler	simplenews scheduler project simplenews scheduler	eq	6.x-2.3
simplenews_scheduler_project:simplenews_scheduler	simplenews scheduler project simplenews scheduler	eq	6.x-2.x