4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.967 High
EPSS
Percentile
99.7%
The Privatemsg module allows users to send private messages between to each other. The module doesn’t sufficiently sanitize user names when creating messages.
This vulnerability is mitigated by the fact that it is not possible to create insecure user names through the default user interface. The exploit is only possible in combination with another module that allows this, such as Realname which allows site-builders to choose fields to display an alternative username.
CVE: CVE-2012-4468
Drupal core is not affected. If you do not use the contributed Privatemsg module, there is nothing you need to do.
Install the latest version:
Also see the Privatemsg project page.