CVE-2012-2153: Drupal improper access restrictions
Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 7.14 - Upgrade
Upgrade
Drupalto a version that resolves this vulnerability.Fixed in 7.14
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2153?
CVE-2012-2153 is considered a moderate severity vulnerability.
How do I fix CVE-2012-2153?
To mitigate CVE-2012-2153, upgrade your Drupal installation to version 7.14 or later.
What is the impact of CVE-2012-2153?
CVE-2012-2153 allows authenticated users with certain permissions to view all published nodes, potentially exposing sensitive content.
Is CVE-2012-2153 applicable to all versions of Drupal?
CVE-2012-2153 specifically affects Drupal 7.x versions prior to 7.14.
Who is affected by CVE-2012-2153?
Remote authenticated users with the 'Access the content overview page' permission can be impacted by CVE-2012-2153.