CVE-2012-1650

The CVE-2012-1650 entry concerns the Drupal ZipCart module (6.x) prior to 6.x-1.4. The vulnerability arises because archive creation checks the wrong permission: it uses the generic “access content” permission instead of “access ZipCart downloads,” allowing remote authenticated users who have acc...

SA-CONTRIB-2012-026 - ZipCart - Access bypass

CVE: CVE-2012-1650 ZipCart enables a site to provide users with Zip archives for downloads selected by the user. Versions of ZipCart prior to 6.x-1.4 checks an incorrect permission when building archives. This vulnerability is mitigated by the fact that archive file addition is only permitted if...