Description

The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.

Remediation

References

CVE-2012-1591

Related Vulnerabilities

WordPress Plugin Slider Hero with Animation, Video Background SQL Injection (8.2.6)

Seo Panel Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-28417)

ownCloud CVE-2013-7344 Vulnerability (CVE-2013-7344)

MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-4360)

WordPress Plugin Custom Banners Cross-Site Request Forgery (3.2.2)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2012-1591