Vulnerability Description
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Giantrobot | Zipcart | 6.x-1.2 |
| Drupal | Drupal | - |
Related Weaknesses (CWE)
References
- http://drupalcode.org/project/zipcart.git/commitdiff/fe143c2Patch
- http://www.openwall.com/lists/oss-security/2012/04/07/1
- http://www.osvdb.org/79766
- http://www.securityfocus.com/bid/52231
- https://drupal.org/node/1460892Patch
- https://drupal.org/node/1461446PatchVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73609
- http://drupalcode.org/project/zipcart.git/commitdiff/fe143c2Patch
- http://www.openwall.com/lists/oss-security/2012/04/07/1
- http://www.osvdb.org/79766
- http://www.securityfocus.com/bid/52231
- https://drupal.org/node/1460892Patch
- https://drupal.org/node/1461446PatchVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73609
FAQ
What is CVE-2012-1650?
CVE-2012-1650 is a vulnerability with a CVSS score of 6.0 (MEDIUM). The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated u...
How severe is CVE-2012-1650?
CVE-2012-1650 has been rated MEDIUM with a CVSS base score of 6.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-1650?
Check the references section above for vendor advisories and patch information. Affected products include: Giantrobot Zipcart, Drupal Drupal.