PT-2012-6008 · Drupal · Simplenews Scheduler Module

Forest Monsen · Published 2012-12-03 · Updated 2012-12-04 · CVE-2012-5537

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simplenews Scheduler module versions 6.x-2.x before 6.x-2.4

Description The issue allows remote authenticated users with the "send scheduled newsletters" permission to inject arbitrary PHP code into the scheduling form, which is later executed by cron.

Recommendations For versions 6.x-2.x before 6.x-2.4, update to version 6.x-2.4 or later to resolve the issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2012-5537

Affected Products

Simplenews Scheduler Module

References · 4

• http://drupal.org/node/1789284 · Vendor Advisory
• http://drupal.org/node/1789274 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2012-5537 · Security Note
• http://openwall.com/lists/oss-security/2012/11/20/4 · Note