Vulnerability Details CVE-2012-1650
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 60.3%
CVSS Severity
CVSS v2 Score 6.0
References
- http://drupalcode.org/project/zipcart.git/commitdiff/fe143c2
- http://www.openwall.com/lists/oss-security/2012/04/07/1
- http://www.osvdb.org/79766
- http://www.securityfocus.com/bid/52231
- https://drupal.org/node/1460892
- https://drupal.org/node/1461446
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73609
- http://drupalcode.org/project/zipcart.git/commitdiff/fe143c2
- http://www.openwall.com/lists/oss-security/2012/04/07/1
- http://www.osvdb.org/79766
- http://www.securityfocus.com/bid/52231
- https://drupal.org/node/1460892
- https://drupal.org/node/1461446
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73609
Products affected by CVE-2012-1650
-
cpe:2.3:a:drupal:drupal:-
-
cpe:2.3:a:giantrobot:zipcart:6.x-1.2
-
cpe:2.3:a:giantrobot:zipcart:6.x-1.3
-
cpe:2.3:a:giantrobot:zipcart:6.x-1.x