EUVD-2012-1655

Malware in sbrugna...

CVE-2012-1645: Exposure of Sensitive Information to an Unauthorized Actor

The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php...

PT-2012-3409

Name of the Vulnerable Software and Affected Versions CDN module versions 6.x-2.2 and 7.x-2.2 for Drupal Description The issue allows remote attackers to read arbitrary PHP files via unspecified vectors when the CDN module is running in Origin Pull mode with the "Far Future expiration" option...