CVEvulnerability
CVE-2012-5586
2.1 LOW
Official page ↗
- Status
- Modified
- Published
- 2012-12-26
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:N/AC:H/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user profiles" permission to access arbitrary users' emails via vectors related to the "user index method" and "the path to the user resource."
Affected configurations
• marc ingram services 6.x-3.0
• marc ingram services 6.x-3.1
• marc ingram services 6.x-3.2
• marc ingram services 6.x-3.x
• marc ingram services 7.x-3.0
• marc ingram services 7.x-3.1
• marc ingram services 7.x-3.2
• marc ingram services 7.x-3.3
• marc ingram services 7.x-3.x
Related
Weakness · not in database (1)
References
- http://drupal.org/node/1842022 Patch
- http://drupal.org/node/1842026 Patch
- http://drupal.org/node/1853200 Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/11/29/2 www.openwall.com
- http://www.securityfocus.com/bid/56723 www.securityfocus.com
- http://drupal.org/node/1842022 Patch
- http://drupal.org/node/1842026 Patch
- http://drupal.org/node/1853200 Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/11/29/2 www.openwall.com
- http://www.securityfocus.com/bid/56723 www.securityfocus.com