Vulnerability Description
The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Drupal | Drupal | 7.0 |
Related Weaknesses (CWE)
References
- http://drupal.org/drupal-7.14Vendor Advisory
- http://drupal.org/node/1302404Patch
- http://drupal.org/node/1557938Vendor Advisory
- http://drupalcode.org/project/drupal.git/commit/352645e4a636cadeb5576231b3547972Exploit
- http://secunia.com/advisories/49012
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:074
- http://www.securityfocus.com/bid/53359
- http://drupal.org/drupal-7.14Vendor Advisory
- http://drupal.org/node/1302404Patch
- http://drupal.org/node/1557938Vendor Advisory
- http://drupalcode.org/project/drupal.git/commit/352645e4a636cadeb5576231b3547972Exploit
- http://secunia.com/advisories/49012
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:074
- http://www.securityfocus.com/bid/53359
FAQ
What is CVE-2012-1590?
CVE-2012-1590 is a vulnerability with a CVSS score of 4.0 (MEDIUM). The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post ...
How severe is CVE-2012-1590?
CVE-2012-1590 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-1590?
Check the references section above for vendor advisories and patch information. Affected products include: Drupal Drupal.