PT-2012-5429 · Drupal · Drupal Commons

Joshua Brauer · Published 2012-10-31 · Updated 2012-11-13 · CVE-2012-4483

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal Commons module versions 6.x-2.x before 6.x-2.8

Description The issue is related to the commons discussion views default views function in the Drupal Commons module, which does not properly enforce intended node access restrictions. This might allow remote attackers to obtain sensitive information via the recent comments listing.

Recommendations For versions prior to 6.x-2.8, update to version 6.x-2.8 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-4483

Affected Products

Drupal Commons

References · 6

• http://drupal.org/node/1679908 · Patch
• http://drupalcode.org/project/commons.git/commitdiff/8ef688b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2012-4483 · Security Note
• http://drupal.org/node/1679820 · Note
• http://openwall.com/lists/oss-security/2012/10/07/1 · Note
• http://openwall.com/lists/oss-security/2012/10/04/6 · Note