5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.01 Low
EPSS
Percentile
83.2%
CVE: CVE-2012-1588
Drupal core’s text filtering system provides several features including removing inappropriate HTML tags and automatically linking content that appears to be a link. A pattern in Drupal’s text matching was found to be inefficient with certain specially crafted strings. This vulnerability is mitigated by the fact that users must have the ability to post content sent to the filter system such as a role with the “post comments” or “Forum topic: Create new content” permission.
CVE: CVE-2012-1589
Drupal core’s Form API allows users to set a destination, but failed to validate that the URL was internal to the site. This weakness could be abused to redirect the login to a remote site with a malicious script that harvests the login credentials and redirects to the live site. This vulnerability is mitigated only by the end user’s ability to recognize a URL with malicious query parameters to avoid the social engineering required to exploit the problem.
CVE: CVE-2012-1590
Drupal core’s forum lists fail to check user access to nodes when displaying them in the forum overview page. If an unpublished node was the most recently updated in a forum then users who should not have access to unpublished forum posts were still be able to see meta-data about the forum post such as the post title.
CVE: CVE-2012-1591
Drupal core provides the ability to have private files, including images, and Image Styles which create derivative images from an original image that may differ, for example, in size or saturation. Drupal core failed to properly terminate the page request for cached image styles allowing users to access image derivatives for images they should not be able to view. Furthermore, Drupal didn’t set the right headers to prevent image styles from being cached in the browser.
CVE: CVE-2012-2153
Drupal core provides the ability to list nodes on a site at admin/content. Drupal core failed to confirm a user viewing that page had access to each node in the list. This vulnerability only concerns sites running a contributed node access module and is mitigated by the fact that users must have a role with the “Access the content overview page” permission. Unpublished nodes were not displayed to users who only had the “Access the content overview page” permission.
Install the latest version:
Also see the Drupal core project page.
drupal.org/contact
drupal.org/node/1558412
drupal.org/project/drupal
drupal.org/security-team
drupal.org/security-team/risk-levels
drupal.org/security/secure-configuration
drupal.org/user/102818
drupal.org/user/1271628
drupal.org/user/155601
drupal.org/user/16747
drupal.org/user/170314
drupal.org/user/1792496
drupal.org/user/22211
drupal.org/user/243377
drupal.org/user/36762
drupal.org/user/396253
drupal.org/user/414525
drupal.org/user/52142
drupal.org/user/65776
drupal.org/user/91990
drupal.org/user/923254
drupal.org/user/9446
drupal.org/writing-secure-code