CVEvulnerability
CVE-2012-1590
4.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-10-01
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page.
Affected configurations
• drupal drupal 7.0
• drupal drupal 7.1
• drupal drupal 7.2
• drupal drupal 7.3
• drupal drupal 7.4
• drupal drupal 7.5
• drupal drupal 7.6
• drupal drupal 7.7
• drupal drupal 7.8
• drupal drupal 7.9
• drupal drupal 7.10
• drupal drupal 7.11
• drupal drupal 7.12
• drupal drupal 7.13
• drupal drupal 7.x-dev
Related
Weakness · not in database (1)
References
- http://drupal.org/drupal-7.14 Vendor Advisory
- http://drupal.org/node/1302404 Patch
- http://drupal.org/node/1557938 Vendor Advisory
- http://drupalcode.org/project/drupal.git/commit/352645e4a636cadeb5576231b3547972eebdd8e5 Exploit
- http://secunia.com/advisories/49012 secunia.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:074 www.mandriva.com
- http://www.securityfocus.com/bid/53359 www.securityfocus.com
- http://drupal.org/drupal-7.14 Vendor Advisory
- http://drupal.org/node/1302404 Patch
- http://drupal.org/node/1557938 Vendor Advisory
- http://drupalcode.org/project/drupal.git/commit/352645e4a636cadeb5576231b3547972eebdd8e5 Exploit
- http://secunia.com/advisories/49012 secunia.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:074 www.mandriva.com
- http://www.securityfocus.com/bid/53359 www.securityfocus.com