Access bypass in Drupal - CVE-2012-5651

Vulnerability identifier: #VU461

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2012-5651

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to get access to valid user's search results.
The weakness exists due to access control error and allows to see the blocked users in search results reguardless user's priveleges.
Successful exploitation of the vulnerability results in appearing of blocked users in search results.

Drupal
Fedora
drupal6
drupal7

Update 6.x to 6.27.
https://www.drupal.org/drupal-6.27-release-notes
Update 7.x to 7.18.
https://www.drupal.org/drupal-7.18-release-notes

drupal6 - addressed in versions 6.27-1.el5, 6.27-1.el6
drupal7 - addressed in versions 7.18-1.el5, 7.18-1.el6

• https://www.drupal.org/SA-CORE-2012-004

• Access bypass in Drupal Drupal
• Fedora EPEL 6 update for drupal6, drupal7
• Fedora EPEL 5 update for drupal6, drupal7