CVE-2012-5653: Input Validation
The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5653?
CVE-2012-5653 is rated as a medium severity vulnerability due to its ability to allow remote authenticated users to execute arbitrary PHP code.
How do I fix CVE-2012-5653?
To fix CVE-2012-5653, upgrade your Drupal installation to version 6.27 or 7.18 or later.
Who is affected by CVE-2012-5653?
CVE-2012-5653 affects users of Drupal versions 6.x before 6.27 and 7.x before 7.18.
What types of attacks can be conducted using CVE-2012-5653?
CVE-2012-5653 allows attackers to upload files with null byte characters in the name, enabling them to execute arbitrary PHP code.
Is there a workaround for CVE-2012-5653?
No official workaround is available for CVE-2012-5653; upgrading to the latest version of Drupal is the recommended mitigation.