CVE-2012-2730

The Protected Node module 6.x-1.x before 6.x-1.6 for Drupal does not properly "protect node access when nodes are accessed outside of the standard node view," which allows remote attackers to bypass intended access restrictions.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://drupal.org/node/1258034	Patch
http://drupal.org/node/1632918	Patch Vendor Advisory
http://secunia.com/advisories/49509	Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/06/14/3
http://www.osvdb.org/82984
http://www.securityfocus.com/bid/54001
https://exchange.xforce.ibmcloud.com/vulnerabilities/76291
http://drupal.org/node/1258034	Patch
http://drupal.org/node/1632918	Patch Vendor Advisory
http://secunia.com/advisories/49509	Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/06/14/3
http://www.osvdb.org/82984
http://www.securityfocus.com/bid/54001
https://exchange.xforce.ibmcloud.com/vulnerabilities/76291

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:alexis_wilke:protected_node:6.x-1.0:::::::*
	cpe:2.3:a:alexis_wilke:protected_node:6.x-1.2:::::::*
	cpe:2.3:a:alexis_wilke:protected_node:6.x-1.3:::::::*
	cpe:2.3:a:alexis_wilke:protected_node:6.x-1.4:::::::*
	cpe:2.3:a:alexis_wilke:protected_node:6.x-1.5:::::::*
	cpe:2.3:a:alexis_wilke:protected_node:6.x-1.x:dev::::::

cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2012-06-27 00:55

Updated : 2025-04-11 00:51

NVD link : CVE-2012-2730

Mitre link : CVE-2012-2730

CVE.ORG link : CVE-2012-2730

JSON object : View

Products Affected

drupal

drupal

alexis_wilke

protected_node

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2012-2730", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-06-27T00:55:05.443", "references": [{"url": "http://drupal.org/node/1258034", "tags": ["Patch"], "source": "secalert@redhat.com"}, {"url": "http://drupal.org/node/1632918", "tags": ["Patch", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/49509", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2012/06/14/3", "source": "secalert@redhat.com"}, {"url": "http://www.osvdb.org/82984", "source": "secalert@redhat.com"}, {"url": "http://www.securityfocus.com/bid/54001", "source": "secalert@redhat.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/76291", "source": "secalert@redhat.com"}, {"url": "http://drupal.org/node/1258034", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://drupal.org/node/1632918", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/49509", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2012/06/14/3", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.osvdb.org/82984", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/54001", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/76291", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The Protected Node module 6.x-1.x before 6.x-1.6 for Drupal does not properly \"protect node access when nodes are accessed outside of the standard node view,\" which allows remote attackers to bypass intended access restrictions."}, {"lang": "es", "value": "El m\u00f3dulo Protected Node v6.x-1.x anterior a v6.x-1.6 para Drupal no protege de forma adecuada el acceso al nodo protegido cuando se accede a los nodos desde una vista que no es la est\u00e1ndar, lo que permitir\u00eda a atacantes remotos a evitar las restricciones de acceso impuestas."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:alexis_wilke:protected_node:6.x-1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5C93E46-ADC2-4279-986F-460C1B52A26A"}, {"criteria": "cpe:2.3:a:alexis_wilke:protected_node:6.x-1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FD8F17C-3A41-48A6-B8AC-79947D19F050"}, {"criteria": "cpe:2.3:a:alexis_wilke:protected_node:6.x-1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "282E6BE5-1AF6-403D-9A94-E78BB9D23A76"}, {"criteria": "cpe:2.3:a:alexis_wilke:protected_node:6.x-1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBBD9435-2E0A-447F-BDA7-FC41D150A627"}, {"criteria": "cpe:2.3:a:alexis_wilke:protected_node:6.x-1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "590AB5D2-18D0-4CF4-B81E-2DE0634D38EA"}, {"criteria": "cpe:2.3:a:alexis_wilke:protected_node:6.x-1.x:dev:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A24380E6-C57D-4414-A041-2FB55001C040"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F8B1170D-AD33-4C7A-892D-63AC71B032CF"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "secalert@redhat.com"}