CVE-2012-4483 The commons_discussion_views_default_views function in modules/features/commons_discussion/commons_discussion.views_default.inc in the Drupal Commons module 6.x-2.x before 6.x-2.8 for Drupal does not....

MediumCVSS 5.0 EPSS 1.4%

Published: 2012-10-31 18:00
Updated: 2026-06-17 02:45
Exploit status: No public exploit known

Description

The commons_discussion_views_default_views function in modules/features/commons_discussion/commons_discussion.views_default.inc in the Drupal Commons module 6.x-2.x before 6.x-2.8 for Drupal does not properly enforce intended node access restrictions, which might allow remote attackers to obtain sensitive information via the recent comments listing.

Affected products

Product	Affected versions	Fixed in
acquia commons	= 6.x-2.4	No fix listed
acquia commons	= 6.x-2.5	No fix listed
acquia commons	= 6.x-2.6	No fix listed
acquia commons	= 6.x-2.7	No fix listed
acquia commons	= 6.x-2.x-dev	No fix listed

References

drupal.org
drupal.org patch
drupalcode.org patch
[oss-security] 20121004 CVE Request for Drupal Contributed Modules mailing-list
[oss-security] 20121007 Re: CVE Request for Drupal Contributed Modules mailing-list

CVSS v2.0

5.0 Medium

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: None
Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.37% (percentile 72.3)
CWE: CWE-264

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.