PT-2012-3413 · Drupal · Cool Aid

Published 2012-09-09 · Updated 2017-08-29 · CVE-2012-1649

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cool Aid module versions prior to 6.x-1.9 for Drupal

Description The issue concerns the Cool Aid module for Drupal, where access restrictions are not properly enforced. This allows remote authenticated users with the administer coolaid permission to modify arbitrary pages.

Recommendations For Cool Aid module versions prior to 6.x-1.9, update to version 6.x-1.9 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-1649

Affected Products

Cool Aid

References · 8

• http://drupal.org/node/1417186 · Patch
• http://secunia.com/advisories/48196 · Vendor Advisory
• http://drupal.org/node/1461438 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1649 · Security Note
• http://securityfocus.com/bid/52232 · Note
• http://osvdb.org/79772 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73608 · Note
• http://openwall.com/lists/oss-security/2012/04/07/1 · Note