PT-2012-5445 · Drupal · Email Field

Joshua Brauer · Published 2012-10-31 · Updated 2012-11-01 · CVE-2012-4499

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Email Field module versions 6.x-1.x before 6.x-1.2 Email Field module versions 7.x-1.x before 7.x-1.1

Description The issue affects the contact formatter page in the Email Field module, allowing remote attackers to email the stored address in the entity. The attack vector is not specified.

Recommendations For Email Field module versions 6.x-1.x before 6.x-1.2, update to version 6.x-1.2 or later. For Email Field module versions 7.x-1.x before 7.x-1.1, update to version 7.x-1.1 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-4499

Affected Products

Email Field

References · 6

• http://drupal.org/node/1761948 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2012-4499 · Security Note
• http://drupal.org/node/1762470 · Vendor Advisory
• http://drupal.org/node/1761968 · Patch
• http://openwall.com/lists/oss-security/2012/10/07/1 · Note
• http://openwall.com/lists/oss-security/2012/10/04/6 · Note