PT-2012-4212 · Drupal+1 · Node Embed+1

Published 2012-06-27 · Updated 2017-08-29 · CVE-2012-2722

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Node Embed module versions 6.x-1.x before 6.x-1.5 Node Embed module versions 7.x-1.x before 7.x-1.0

Description The issue is related to the node selection interface in the WYSIWYG editor (CKEditor) of the Node Embed module for Drupal. It does not properly check permissions, allowing remote attackers to bypass intended access restrictions and read node titles.

Recommendations For Node Embed module versions 6.x-1.x before 6.x-1.5, update to version 6.x-1.5 or later. For Node Embed module versions 7.x-1.x before 7.x-1.0, update to version 7.x-1.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-2722

Affected Products

Ckeditor

Node Embed

References · 11

• 🔥 http://drupalcode.org/project/node_embed.git/commitdiff/7a2296c · Exploit
• 🔥 http://drupalcode.org/project/node_embed.git/commitdiff/d06f022 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2722 · Security Note
• http://drupal.org/node/1618430 · Patch
• http://drupal.org/node/1619824 · Vendor Advisory
• http://secunia.com/advisories/48348 · Vendor Advisory
• http://drupal.org/node/1618428 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76148 · Note
• http://openwall.com/lists/oss-security/2012/06/14/3 · Note
• http://securityfocus.com/bid/53835 · Note
• http://osvdb.org/82735 · Note