CVEvulnerability
CVE-2012-1650
6.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-08-28
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
Affected configurations
• giantrobot zipcart 6.x-1.2
• giantrobot zipcart 6.x-1.3
• giantrobot zipcart 6.x-1.x
Related
Weakness · not in database (1)
References
- http://drupalcode.org/project/zipcart.git/commitdiff/fe143c2 Patch
- http://www.openwall.com/lists/oss-security/2012/04/07/1 www.openwall.com
- http://www.osvdb.org/79766 www.osvdb.org
- http://www.securityfocus.com/bid/52231 www.securityfocus.com
- https://drupal.org/node/1460892 Patch
- https://drupal.org/node/1461446 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73609 exchange.xforce.ibmcloud.com
- http://drupalcode.org/project/zipcart.git/commitdiff/fe143c2 Patch
- http://www.openwall.com/lists/oss-security/2012/04/07/1 www.openwall.com
- http://www.osvdb.org/79766 www.osvdb.org
- http://www.securityfocus.com/bid/52231 www.securityfocus.com
- https://drupal.org/node/1460892 Patch
- https://drupal.org/node/1461446 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73609 exchange.xforce.ibmcloud.com