CVE-2012-1650 The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated u...
MediumCVSS 6.0
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| giantrobot zipcart | = 6.x-1.2 | No fix listed |
| giantrobot zipcart | = 6.x-1.3 | No fix listed |
| giantrobot zipcart | = 6.x-1.x-dev | No fix listed |
References
- drupalcode.org patch
- [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) mailing-list
- 79766 vdb-entry
- 52231 vdb-entry
- drupal.org patch
- drupal.org patch vendor-advisory
- zipcart-archives-security-bypass(73609) vdb-entry