CVEvulnerability
CVE-2012-1591
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-10-01
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
Affected configurations
• drupal drupal 7.0
• drupal drupal 7.1
• drupal drupal 7.2
• drupal drupal 7.3
• drupal drupal 7.4
• drupal drupal 7.5
• drupal drupal 7.6
• drupal drupal 7.7
• drupal drupal 7.8
• drupal drupal 7.9
• drupal drupal 7.10
• drupal drupal 7.11
• drupal drupal 7.12
• drupal drupal 7.13
• drupal drupal 7.x-dev
Related
Weakness · not in database (1)
References
- http://drupal.org/drupal-7.14 Patch
- http://drupal.org/node/1507988 drupal.org
- http://drupal.org/node/1557938 Vendor Advisory
- http://drupalcode.org/project/drupal.git/commit/3bf6761ff7537dc68e22ea73f155134f3cfd41a8 drupalcode.org
- http://secunia.com/advisories/49012 secunia.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:074 www.mandriva.com
- http://www.securityfocus.com/bid/53359 www.securityfocus.com
- http://drupal.org/drupal-7.14 Patch
- http://drupal.org/node/1507988 drupal.org
- http://drupal.org/node/1557938 Vendor Advisory
- http://drupalcode.org/project/drupal.git/commit/3bf6761ff7537dc68e22ea73f155134f3cfd41a8 drupalcode.org
- http://secunia.com/advisories/49012 secunia.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:074 www.mandriva.com
- http://www.securityfocus.com/bid/53359 www.securityfocus.com