CVE-2012-1590

medium

Description

The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page.

References

http://www.securityfocus.com/bid/53359

http://www.mandriva.com/security/advisories?name=MDVSA-2013:074

http://secunia.com/advisories/49012

http://drupal.org/node/1557938

http://drupal.org/node/1302404

http://drupal.org/drupal-7.14

Details

Source: Mitre, NVD

Published: 2012-10-01

Updated: 2013-12-13

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 4.3

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N