Lucene search
HistoryDec 03, 2012 - 9:55 p.m.
CVE-2012-5537
CVSS2
6
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
AI Score
6.6
Confidence
Low
EPSS
0.003
Percentile
71.6%
The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the “send scheduled newsletters” permission to inject arbitrary PHP code into the scheduling form, which is later executed by cron.
Affected configurations
Node
simplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.0
ORsimplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.0beta2
ORsimplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.0beta3
ORsimplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.0beta4
ORsimplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.1
ORsimplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.2
ORsimplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.3
ORsimplenews_scheduler_projectsimplenews_schedulerMatch6.x-2.xdev
drupaldrupalMatch-
| Vendor | Product | Version | CPE |
|---|---|---|---|
| simplenews_scheduler_project | simplenews_scheduler | 6.x-2.0 | cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.0:*:*:*:*:*:*:* |
| simplenews_scheduler_project | simplenews_scheduler | 6.x-2.0 | cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.0:beta2:*:*:*:*:*:* |
| simplenews_scheduler_project | simplenews_scheduler | 6.x-2.0 | cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.0:beta3:*:*:*:*:*:* |
| simplenews_scheduler_project | simplenews_scheduler | 6.x-2.0 | cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.0:beta4:*:*:*:*:*:* |
| simplenews_scheduler_project | simplenews_scheduler | 6.x-2.1 | cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.1:*:*:*:*:*:*:* |
| simplenews_scheduler_project | simplenews_scheduler | 6.x-2.2 | cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.2:*:*:*:*:*:*:* |
| simplenews_scheduler_project | simplenews_scheduler | 6.x-2.3 | cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.3:*:*:*:*:*:*:* |
| simplenews_scheduler_project | simplenews_scheduler | 6.x-2.x | cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.x:dev:*:*:*:*:*:* |
| drupal | drupal | - | cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:* |
Related
prion
prion
Code injection
2012-12-03 21:55:00
cvelist
cvelist
CVE-2012-5537
2012-12-03 21:00:00
drupal
drupal
SA-CONTRIB-2012-146 - Simplenews Scheduler - Arbitrary code execution
2012-09-19 00:00:00
cve
cve
CVE-2012-5537
2012-12-03 21:55:01
CVSS2
6
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
AI Score
6.6
Confidence
Low
EPSS
0.003
Percentile
71.6%
Related for NVD:CVE-2012-5537