PT-2012-6038 · Drupal · Email Field

Forest Monsen · Published 2012-12-26 · Updated 2012-12-27 · CVE-2012-5588

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Email Field module versions 6.x-1.x before 6.x-1.3 for Drupal

Description The issue allows remote attackers to email the stored address via unspecified vectors when the field contact field formatter is set to the full or teaser display mode and a field permission module is used. This occurs due to improper permission checking.

Recommendations For Email Field module versions 6.x-1.x before 6.x-1.3, update to version 6.x-1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the field contact field formatter when set to the full or teaser display mode until the update is applied.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-5588

Affected Products

Email Field

References · 4

• http://drupal.org/node/1852612 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2012-5588 · Security Note
• http://drupal.org/node/1853214 · Vendor Advisory
• http://openwall.com/lists/oss-security/2012/11/29/2 · Note