CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
83.6%
The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allows remote attackers to obtain sensitive information via the confirmation page.
Vendor | Product | Version | CPE |
---|---|---|---|
md-systems | simplenews | 6.x-1.0 | cpe:2.3:a:md-systems:simplenews:6.x-1.0:-:*:*:*:drupal:*:* |
md-systems | simplenews | 6.x-1.0 | cpe:2.3:a:md-systems:simplenews:6.x-1.0:beta1:*:*:*:drupal:*:* |
md-systems | simplenews | 6.x-1.0 | cpe:2.3:a:md-systems:simplenews:6.x-1.0:beta2:*:*:*:drupal:*:* |
md-systems | simplenews | 6.x-1.0 | cpe:2.3:a:md-systems:simplenews:6.x-1.0:beta3:*:*:*:drupal:*:* |
md-systems | simplenews | 6.x-1.0 | cpe:2.3:a:md-systems:simplenews:6.x-1.0:beta4:*:*:*:drupal:*:* |
md-systems | simplenews | 6.x-1.0 | cpe:2.3:a:md-systems:simplenews:6.x-1.0:beta5:*:*:*:drupal:*:* |
md-systems | simplenews | 6.x-1.0 | cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc1:*:*:*:drupal:*:* |
md-systems | simplenews | 6.x-1.0 | cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc2:*:*:*:drupal:*:* |
md-systems | simplenews | 6.x-1.0 | cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc3:*:*:*:drupal:*:* |
md-systems | simplenews | 6.x-1.0 | cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc4:*:*:*:drupal:*:* |
[
{
"product": "Simplenews",
"vendor": "Simplenews",
"versions": [
{
"status": "affected",
"version": "6.x-1.x before 6.x-1.4"
},
{
"status": "affected",
"version": "6.x-2.x before 6.x-2.0-alpha4"
},
{
"status": "affected",
"version": "and 7.x-1.x before 7.x-1.0-rc1"
}
]
}
]
drupal.org/node/1619812
drupal.org/node/1619818
drupal.org/node/1619820
drupal.org/node/1619848
drupalcode.org/project/simplenews.git/commitdiff/36352c1
drupalcode.org/project/simplenews.git/commitdiff/6d5704c
drupalcode.org/project/simplenews.git/commitdiff/faec6a6
www.openwall.com/lists/oss-security/2012/06/14/3
www.securityfocus.com/bid/53839
exchange.xforce.ibmcloud.com/vulnerabilities/76143
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
83.6%