Access bypass in Drupal - CVE-2012-1591
Published: September 15, 2016 / Updated: March 14, 2017
Vulnerability identifier: #VU472
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2012-1591
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Drupal
Affected software:
Drupal
Drupal
Detailed vulnerability description
The vulnerability allows a remote user to get access to private files, especially images, on the target system.
The weakness exists due to improper image derivatives protection that may result in attacker's access to the images he wasn't allowed to see before.
Successful exploitation of the vulnerability allows a malicious user to obtain unallowed images.
The weakness exists due to improper image derivatives protection that may result in attacker's access to the images he wasn't allowed to see before.
Successful exploitation of the vulnerability allows a malicious user to obtain unallowed images.
How to mitigate CVE-2012-1591
Update to 7.13.
https://www.drupal.org/node/1558412
https://www.drupal.org/node/1558412