CVEvulnerability
CVE-2012-1645
2.6 LOW
Official page ↗
- Status
- Modified
- Published
- 2012-08-28
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 2.6 LOW — AV:N/AC:H/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php.
Affected configurations
• wimleers cdn 6.x-2.2
• wimleers cdn 7.x-2.2
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://drupal.org/node/1441480 drupal.org
- http://drupal.org/node/1441482 Patch
- http://drupalcode.org/project/cdn.git/commitdiff/cd2a5ff Patch
- http://drupalcode.org/project/cdn.git/commitdiff/eca85e6 Patch
- http://secunia.com/advisories/48032 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/04/07/1 www.openwall.com
- http://www.osvdb.org/79317 www.osvdb.org
- https://drupal.org/node/1441502 Patch, Vendor Advisory
- http://drupal.org/node/1441480 drupal.org
- http://drupal.org/node/1441482 Patch
- http://drupalcode.org/project/cdn.git/commitdiff/cd2a5ff Patch
- http://drupalcode.org/project/cdn.git/commitdiff/eca85e6 Patch
- http://secunia.com/advisories/48032 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/04/07/1 www.openwall.com
- http://www.osvdb.org/79317 www.osvdb.org
- https://drupal.org/node/1441502 Patch, Vendor Advisory