CVE-2012-5586 The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user profiles" permission to access arbitrary users' emails via vect...
LowCVSS 2.1
EPSS 0.96%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user profiles" permission to access arbitrary users' emails via vectors related to the "user index method" and "the path to the user resource."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| marc ingram services | = 6.x-3.0 | No fix listed |
| marc ingram services | = 6.x-3.0-alpha1 | No fix listed |
| marc ingram services | = 6.x-3.0-beta1 | No fix listed |
| marc ingram services | = 6.x-3.0-beta2 | No fix listed |
| marc ingram services | = 6.x-3.0-rc1 | No fix listed |
| marc ingram services | = 6.x-3.0-rc2 | No fix listed |
| marc ingram services | = 6.x-3.0-rc3 | No fix listed |
| marc ingram services | = 6.x-3.0-rc4 | No fix listed |
| marc ingram services | = 6.x-3.0-unstable1 | No fix listed |
| marc ingram services | = 6.x-3.0-unstable2 | No fix listed |
| marc ingram services | = 6.x-3.0-unstable3 | No fix listed |
| marc ingram services | = 6.x-3.1 | No fix listed |
| marc ingram services | = 6.x-3.2 | No fix listed |
| marc ingram services | = 6.x-3.x-dev | No fix listed |
| marc ingram services | = 7.x-3.0 | No fix listed |
| marc ingram services | = 7.x-3.0-beta1 | No fix listed |
| marc ingram services | = 7.x-3.0-beta2 | No fix listed |
| marc ingram services | = 7.x-3.0-rc1 | No fix listed |
| marc ingram services | = 7.x-3.0-rc2 | No fix listed |
| marc ingram services | = 7.x-3.0-rc3 | No fix listed |
| marc ingram services | = 7.x-3.0-rc4 | No fix listed |
| marc ingram services | = 7.x-3.0-rc5 | No fix listed |
| marc ingram services | = 7.x-3.0-rc6 | No fix listed |
| marc ingram services | = 7.x-3.1 | No fix listed |
| marc ingram services | = 7.x-3.2 | No fix listed |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| marc ingram services | = 7.x-3.3 | No fix listed |
| marc ingram services | = 7.x-3.x-dev | No fix listed |
References
- drupal.org patch
- drupal.org patch
- drupal.org patch vendor-advisory
- [oss-security] 20121128 Re: CVE request for Drupal contributed modules mailing-list
- 56723 vdb-entry