PT-2012-5418 · Drupal · Listhandler

Joshua Brauer · Published 2012-11-30 · Updated 2013-01-30 · CVE-2012-4470

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Listhandler module versions 6.x-1.x before 6.x-1.1 for Drupal

Description The issue concerns the Listhandler module for Drupal, where it fails to properly check permissions when importing emails. This allows remote comment authors to bypass access restrictions, potentially leading to unspecified impacts.

Recommendations For Listhandler module versions 6.x-1.x before 6.x-1.1, update to version 6.x-1.1 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-4470

Affected Products

Listhandler

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2012-4470 · Security Note
• http://drupal.org/node/1679412 · Vendor Advisory
• http://drupal.org/node/1819780 · Patch
• http://securityfocus.com/bid/54376 · Note
• http://openwall.com/lists/oss-security/2012/10/04/3 · Note