First published: Mon Dec 03 2012(Updated: )
The OM Maximenu module 6.x-1.43 and earlier for Drupal, when the "Title has PHP" option is enabled, allows remote authenticated users with the "Administer OM Maximenu" permission to execute arbitrary PHP code via a "Link Title," a different vulnerability than CVE-2012-5553.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Daniel Honrade Om Maximenu | <=6.x-1.43 | |
Daniel Honrade Om Maximenu | =6.x-1.0 | |
Daniel Honrade Om Maximenu | =6.x-1.0-rc1 | |
Daniel Honrade Om Maximenu | =6.x-1.0-rc2 | |
Daniel Honrade Om Maximenu | =6.x-1.0-rc3 | |
Daniel Honrade Om Maximenu | =6.x-1.0-rc4 | |
Daniel Honrade Om Maximenu | =6.x-1.0-rc5 | |
Daniel Honrade Om Maximenu | =6.x-1.0-rc6 | |
Daniel Honrade Om Maximenu | =6.x-1.0-rc7 | |
Daniel Honrade Om Maximenu | =6.x-1.1 | |
Daniel Honrade Om Maximenu | =6.x-1.2 | |
Daniel Honrade Om Maximenu | =6.x-1.3 | |
Daniel Honrade Om Maximenu | =6.x-1.4 | |
Daniel Honrade Om Maximenu | =6.x-1.5 | |
Daniel Honrade Om Maximenu | =6.x-1.6 | |
Daniel Honrade Om Maximenu | =6.x-1.7 | |
Daniel Honrade Om Maximenu | =6.x-1.8 | |
Daniel Honrade Om Maximenu | =6.x-1.9 | |
Daniel Honrade Om Maximenu | =6.x-1.10 | |
Daniel Honrade Om Maximenu | =6.x-1.11 | |
Daniel Honrade Om Maximenu | =6.x-1.12 | |
Daniel Honrade Om Maximenu | =6.x-1.13 | |
Daniel Honrade Om Maximenu | =6.x-1.14 | |
Daniel Honrade Om Maximenu | =6.x-1.15 | |
Daniel Honrade Om Maximenu | =6.x-1.16 | |
Daniel Honrade Om Maximenu | =6.x-1.17 | |
Daniel Honrade Om Maximenu | =6.x-1.18 | |
Daniel Honrade Om Maximenu | =6.x-1.19 | |
Daniel Honrade Om Maximenu | =6.x-1.20 | |
Daniel Honrade Om Maximenu | =6.x-1.21 | |
Daniel Honrade Om Maximenu | =6.x-1.22 | |
Daniel Honrade Om Maximenu | =6.x-1.23 | |
Daniel Honrade Om Maximenu | =6.x-1.24 | |
Daniel Honrade Om Maximenu | =6.x-1.25 | |
Daniel Honrade Om Maximenu | =6.x-1.26 | |
Daniel Honrade Om Maximenu | =6.x-1.27 | |
Daniel Honrade Om Maximenu | =6.x-1.28 | |
Daniel Honrade Om Maximenu | =6.x-1.29 | |
Daniel Honrade Om Maximenu | =6.x-1.30 | |
Daniel Honrade Om Maximenu | =6.x-1.31 | |
Daniel Honrade Om Maximenu | =6.x-1.32 | |
Daniel Honrade Om Maximenu | =6.x-1.33 | |
Daniel Honrade Om Maximenu | =6.x-1.34 | |
Daniel Honrade Om Maximenu | =6.x-1.35 | |
Daniel Honrade Om Maximenu | =6.x-1.36 | |
Daniel Honrade Om Maximenu | =6.x-1.37 | |
Daniel Honrade Om Maximenu | =6.x-1.38 | |
Daniel Honrade Om Maximenu | =6.x-1.39 | |
Daniel Honrade Om Maximenu | =6.x-1.40 | |
Daniel Honrade Om Maximenu | =6.x-1.41 | |
Daniel Honrade Om Maximenu | =6.x-1.42 | |
Daniel Honrade Om Maximenu | =6.x-1.x-dev | |
Drupal Drupal |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2012-6065 is considered a critical vulnerability due to its ability to allow remote authenticated users to execute arbitrary PHP code.
To fix CVE-2012-6065, update the OM Maximenu module to version 6.x-1.44 or later, where the vulnerability has been addressed.
CVE-2012-6065 affects users of the OM Maximenu module versions 6.x-1.43 and earlier who have the 'Administer OM Maximenu' permission.
The 'Title has PHP' option in OM Maximenu allows the execution of PHP code within the link title, contributing to the vulnerability of CVE-2012-6065.
CVE-2012-6065 is a distinct vulnerability and is different from CVE-2012-5553, although both affect the OM Maximenu module.