CVE-2012-5552: Infoleak
Published Dec 3, 2012
·Updated
The Password policy module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to obtain password hashes by sniffing the network, related to "client-side password history checks."
Affected Software
24 affected components
Erikwebb Password Policy=6.x-1.0
Erikwebb Password Policy=6.x-1.0-alpha1
Erikwebb Password Policy=6.x-1.0-alpha2
Erikwebb Password Policy=6.x-1.0-alpha3
Erikwebb Password Policy=6.x-1.0-alpha4
Erikwebb Password Policy=6.x-1.0-beta1
Erikwebb Password Policy=6.x-1.1
Erikwebb Password Policy=6.x-1.2
Erikwebb Password Policy=6.x-1.3
Erikwebb Password Policy=6.x-1.4
Erikwebb Password Policy=6.x-1.x-dev
Erikwebb Password Policy=7.x-1.0
Erikwebb Password Policy=7.x-1.0-beta1
Erikwebb Password Policy=7.x-1.0-beta2
Erikwebb Password Policy=7.x-1.0-beta3
Erikwebb Password Policy=7.x-1.0-beta4
Erikwebb Password Policy=7.x-1.0-rc1
Erikwebb Password Policy=7.x-1.0-rc2
Erikwebb Password Policy=7.x-1.0-rc3
Erikwebb Password Policy=7.x-1.1
Erikwebb Password Policy=7.x-1.2
Erikwebb Password Policy=7.x-1.3
Erikwebb Password Policy=7.x-1.x-dev
Drupal Drupal
Remediation
Patch Available
Patch Available
Patch Available
Event History
Dec 3, 2012
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-5552?
CVE-2012-5552 is classified as a medium severity vulnerability.
2
How do I fix CVE-2012-5552?
To fix CVE-2012-5552, upgrade to Password Policy module versions 6.x-1.5 or 7.x-1.3 or later.
3
What types of attacks can exploit CVE-2012-5552?
CVE-2012-5552 can be exploited by remote attackers sniffing the network to obtain password hashes.
4
Which versions of the Password Policy module are affected by CVE-2012-5552?
CVE-2012-5552 affects Password Policy module versions 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.3.
5
What is the impact of CVE-2012-5552 on users?
The impact of CVE-2012-5552 allows remote attackers to capture user password hashes, potentially leading to unauthorized access.