CVE-2012-1635
Vulnerability from cvelistv5
Published
2012-08-28 16:00
Modified
2024-09-16 19:01
Severity ?
Summary
The hook_node_access function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks the permissions of the current user even when it is called to check permissions of other users, which allows remote attackers to bypass intended access restrictions, as demonstrated when using the XML sitemap module to obtain sensitive information about unpublished content.
References
secalert@redhat.comhttp://drupal.org/node/1407456Patch
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/04/07/1
secalert@redhat.comhttps://drupal.org/node/1409268Patch, Vendor Advisory
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:01:02.848Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://drupal.org/node/1407456"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://drupal.org/node/1409268"
          },
          {
            "name": "[oss-security] 20120406 CVE\u0027s for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/04/07/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The hook_node_access function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks the permissions of the current user even when it is called to check permissions of other users, which allows remote attackers to bypass intended access restrictions, as demonstrated when using the XML sitemap module to obtain sensitive information about unpublished content."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-08-28T16:00:00Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://drupal.org/node/1407456"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://drupal.org/node/1409268"
        },
        {
          "name": "[oss-security] 20120406 CVE\u0027s for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/04/07/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-1635",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The hook_node_access function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks the permissions of the current user even when it is called to check permissions of other users, which allows remote attackers to bypass intended access restrictions, as demonstrated when using the XML sitemap module to obtain sensitive information about unpublished content."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://drupal.org/node/1407456",
              "refsource": "CONFIRM",
              "url": "http://drupal.org/node/1407456"
            },
            {
              "name": "https://drupal.org/node/1409268",
              "refsource": "MISC",
              "url": "https://drupal.org/node/1409268"
            },
            {
              "name": "[oss-security] 20120406 CVE\u0027s for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2012/04/07/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-1635",
    "datePublished": "2012-08-28T16:00:00Z",
    "dateReserved": "2012-03-12T00:00:00Z",
    "dateUpdated": "2024-09-16T19:01:39.028Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2012-1635\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2012-08-28T17:55:01.407\",\"lastModified\":\"2012-08-29T04:00:00.000\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The hook_node_access function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks the permissions of the current user even when it is called to check permissions of other users, which allows remote attackers to bypass intended access restrictions, as demonstrated when using the XML sitemap module to obtain sensitive information about unpublished content.\"},{\"lang\":\"es\",\"value\":\"La funcion hook_node_access en el m\u00f3dulo revisioning v7.x-1.x anterior a v7.x-1.3 para Drupal comprueba los permisos del usuario actual, incluso cuando se le llama para comprobar los permisos de otros usuarios, lo que permite a atacantes remotos evitar las restricciones de acceso, como se demuestra cuando se utiliza el m\u00f3dulo XML Sitemap para obtener informaci\u00f3n sensible acerca del contenido publicado.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.4},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF52E04C-FA27-4A40-8C65-E3195EFDDBAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:alpha1:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB103093-A42E-42BF-99F6-87E7CFC8B202\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:alpha2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3FBBCE5-CBE9-44C2-968B-4AC9C3C9BEFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:alpha3:*:*:*:*:*:*\",\"matchCriteriaId\":\"5BB069EF-CF7C-4E09-A710-C3526E0439B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:alpha4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39C15145-C442-4DB1-944D-8CAC20D475C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:alpha5:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5499411-30C0-49AE-A86A-0CAE4776EEC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"050AE8CD-38A6-422F-BF37-91562EBA1753\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta10:*:*:*:*:*:*\",\"matchCriteriaId\":\"2126DE43-B110-4091-BF89-89B19A65FFC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta11:*:*:*:*:*:*\",\"matchCriteriaId\":\"39A44978-D60E-4BC8-8686-D37DB1A11E8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"88A49A47-BED7-4316-BDB0-B861AF4ACF1A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DFD9AD40-89F5-45AE-B4A5-090F39E510E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"BFCF6DBC-9791-424B-BC65-DC5C990F9C83\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta5:*:*:*:*:*:*\",\"matchCriteriaId\":\"05AEB8FF-3D71-43F0-B315-B85A8088B45B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta6:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE0BAD57-71F6-4D5C-B586-9BFF96A6538C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta7:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7CD6834-3118-4609-8F30-3D539DE57F12\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta8:*:*:*:*:*:*\",\"matchCriteriaId\":\"B10F2925-F3D6-4221-8925-92D1DD9CA6F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta9:*:*:*:*:*:*\",\"matchCriteriaId\":\"437992A2-01B5-4A8C-ABE5-3E7E575FA19F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA56AC18-8534-4A52-8DA8-1295BD42FC77\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F878269-B46B-4FF1-9064-8418878C3716\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.x:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83906B05-3E19-4B71-994A-2EBCB8792074\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rik_de_boer:revisioning:7.x-1.x:dev:*:*:*:*:*:*\",\"matchCriteriaId\":\"3AEFC2CF-4875-45FC-836A-A7B273CDAE1F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F8B1170D-AD33-4C7A-892D-63AC71B032CF\"}]}]}],\"references\":[{\"url\":\"http://drupal.org/node/1407456\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2012/04/07/1\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://drupal.org/node/1409268\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.