CVE-2012-4554 The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file.
MediumCVSS 5.0
EPSS 15.8%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal/drupal | = 7.0 | No fix listed |
| drupal/drupal | = 7.0-alpha1 | No fix listed |
| drupal/drupal | = 7.0-alpha2 | No fix listed |
| drupal/drupal | = 7.0-alpha3 | No fix listed |
| drupal/drupal | = 7.0-alpha4 | No fix listed |
| drupal/drupal | = 7.0-alpha5 | No fix listed |
| drupal/drupal | = 7.0-alpha6 | No fix listed |
| drupal/drupal | = 7.0-alpha7 | No fix listed |
| drupal/drupal | = 7.0-beta1 | No fix listed |
| drupal/drupal | = 7.0-beta2 | No fix listed |
| drupal/drupal | = 7.0-beta3 | No fix listed |
| drupal/drupal | = 7.0-dev | No fix listed |
| drupal/drupal | = 7.0-rc1 | No fix listed |
| drupal/drupal | = 7.0-rc2 | No fix listed |
| drupal/drupal | = 7.0-rc3 | No fix listed |
| drupal/drupal | = 7.0-rc4 | No fix listed |
| drupal/drupal | = 7.1 | No fix listed |
| drupal/drupal | = 7.2 | No fix listed |
| drupal/drupal | = 7.3 | No fix listed |
| drupal/drupal | = 7.4 | No fix listed |
| drupal/drupal | = 7.5 | No fix listed |
| drupal/drupal | = 7.6 | No fix listed |
| drupal/drupal | = 7.7 | No fix listed |
| drupal/drupal | = 7.8 | No fix listed |
| drupal/drupal | = 7.9 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal/drupal | = 7.10 | No fix listed |
| drupal/drupal | = 7.11 | No fix listed |
| drupal/drupal | = 7.12 | No fix listed |
| drupal/drupal | = 7.13 | No fix listed |
| drupal/drupal | = 7.14 | No fix listed |
| drupal/drupal | = 7.15 | No fix listed |
References
- drupal.org patch vendor-advisory
- drupalcode.org patch
- [oss-security] 20121029 CVE request: Drupal SA-CORE-2012-003 mailing-list
- [oss-security] 20121029 Re: CVE request: Drupal SA-CORE-2012-003 mailing-list