CVE-2012-5586: Low severity marc ingram services vulnerability
The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user profiles" permission to access arbitrary users' emails via vectors related to the "user index method" and "the path to the user resource."
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5586?
CVE-2012-5586 has a medium severity rating due to its potential to expose user email addresses to unauthorized access.
How do I fix CVE-2012-5586?
To fix CVE-2012-5586, upgrade the Services module to version 6.x-3.3 or 7.x-3.3 or later.
Who is affected by CVE-2012-5586?
CVE-2012-5586 affects Drupal users who have the 'access user profiles' permission in versions of the Services module prior to 6.x-3.3 and 7.x-3.3.
What types of user data are exposed in CVE-2012-5586?
CVE-2012-5586 exposes arbitrary user email addresses to authenticated users with certain permissions.
When was CVE-2012-5586 disclosed?
CVE-2012-5586 was disclosed on September 25, 2012.