CVEvulnerability
CVE-2012-2073
6.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-08-14
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The Bundle copy module 7.x-1.x before 7.x-1.1 for Drupal does not check for the "use PHP for settings" permission while importing settings, which allows remote authenticated users with certain permissions to execute arbitrary PHP code via unspecified vectors.
Affected configurations
• kristof de jaeger bundle copy 7.x-1.0
• kristof de jaeger bundle copy 7.x-1.x
Related
Weakness · not in database (1)
References
- http://drupal.org/node/1506166 Patch
- http://drupal.org/node/1506420 Patch, Vendor Advisory
- http://drupalcode.org/project/bundle_copy.git/commit/299bdca drupalcode.org
- http://osvdb.org/80676 osvdb.org
- http://secunia.com/advisories/48626 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/04/07/1 www.openwall.com
- http://www.securityfocus.com/bid/52811 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74439 exchange.xforce.ibmcloud.com
- http://drupal.org/node/1506166 Patch
- http://drupal.org/node/1506420 Patch, Vendor Advisory
- http://drupalcode.org/project/bundle_copy.git/commit/299bdca drupalcode.org
- http://osvdb.org/80676 osvdb.org
- http://secunia.com/advisories/48626 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/04/07/1 www.openwall.com
- http://www.securityfocus.com/bid/52811 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74439 exchange.xforce.ibmcloud.com