CVE-2012-5586

The Drupal Services module (versions 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3) is affected. Remote authenticated users who have the "access user profiles" permission can disclose arbitrary users’ email addresses via the user index method and the path to the user resource. This is caused ...

SA-CONTRIB-2012-168 - Services - Information Disclosure

This module enables you to access content from a remote client. The module doesn't sufficiently adhere to standard Drupal permissions and exposes users emails via the user index method. This vulnerability is mitigated by the fact that an attacker most know the path to the user resource and must b...