Description

Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page.

Remediation

References

CVE-2012-2153

Related Vulnerabilities

Jenkins Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-5323)

Oracle JRE Improper Certificate Validation Vulnerability (CVE-2003-1229)

WebLogic CVE-2023-22069 Vulnerability (CVE-2023-22069)

WordPress 4.1.x Multiple Vulnerabilities (4.1 - 4.1.38)

Undertow Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Vulnerability (CVE-2017-7559)

Severity

Medium

Classification

CVE-2012-2153 CWE-264

Tags

Missing Update Known Vulnerabilities