Access bypass in Drupal Drupal

1) Access bypass

EUVDB-ID: #VU473

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2012-2153

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerabiity allows a remote privileged user to get access to nodes from the list on site at admin/content.
The weakness exists due to access control error and leads to obtaining nodes of content administration.
Successful exploitation of the vulnerability allows user to acces content nodes.

Mitigation

Update to 7.13.
https://www.drupal.org/node/1558412

Vulnerable software versions

Drupal: 7.1 - 7.12

External links

http://www.drupal.org/SA-CORE-2012-002

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.