GitHub Advisoryadvisory · Packagist

GHSA-vpm6-h53m-x2xf Drupal improper access restrictions

MEDIUM Published 2022-05-17 Modified 2023-08-29 Official page ↗
Aliases
CVE-2012-2153
Ecosystem
Packagist
Packages
drupal/drupal
Severity
Moderate
Weaknesses
CWE-284
Reviewed
2023-08-29

Affected packages

• Packagist drupal/drupal: >= 7.0, < 7.14 → fixed in 7.14

Description

Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page.

Related

Alias · CVE (1)

  • CVE-2012-2153 Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References