Lucene search

[email protected]CVE-2012-1650

HistoryAug 28, 2012 - 5:55 p.m.

CVE-2012-1650

2012-08-2817:55:04

CWE-264

[email protected]

web.nvd.nist.gov

cve-2012-1650

zipcart

drupal

security vulnerability

access restriction

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

6.5 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

74.1%

JSON

The ZipCart module 6.x before 6.x-1.4 for Drupal checks the “access content” permission instead of the “access ZipCart downloads” permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.

Affected configurations

NVD

Node

giantrobotzipcartMatch6.x-1.2

giantrobotzipcartMatch6.x-1.3

giantrobotzipcartMatch6.x-1.xdev

AND

drupaldrupalMatch-

CPENameOperatorVersion
giantrobot:zipcartgiantrobot zipcarteq6.x-1.2
giantrobot:zipcartgiantrobot zipcarteq6.x-1.3
giantrobot:zipcartgiantrobot zipcarteq6.x-1.x

CPE	Name	Operator	Version
giantrobot:zipcart	giantrobot zipcart	eq	6.x-1.2
giantrobot:zipcart	giantrobot zipcart	eq	6.x-1.3
giantrobot:zipcart	giantrobot zipcart	eq	6.x-1.x

References

drupalcode.org/project/zipcart.git/commitdiff/fe143c2

www.openwall.com/lists/oss-security/2012/04/07/1

www.osvdb.org/79766

www.securityfocus.com/bid/52231

drupal.org/node/1460892

drupal.org/node/1461446

exchange.xforce.ibmcloud.com/vulnerabilities/73609

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

6.5 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

74.1%

JSON

Related for CVE-2012-1650

nvd1 cvelist1 drupal1 prion1