Unscored severity · published Jul 18, 2012
CVE-2012-2303
The Spaces module 6.x-3.x before 6.x-3.4 for Drupal does not enforce permissions on non-object pages, which allows remote attackers to obtain sensitive information and possibly…
–
CVSS
2%
EPSS
No
On KEV
Description
The Spaces module 6.x-3.x before 6.x-3.4 for Drupal does not enforce permissions on non-object pages, which allows remote attackers to obtain sensitive information and possibly have other impacts via unspecified vectors to the (1) Spaces or (2) Spaces OG module.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Spaces · Florian Weber
6.x-3.0; 6.x-3.0; 6.x-3.0; 6.x-3.0; 6.x-3.0; 6.x-3.0; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2303
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2303
Patch
http://drupal.org/node/1547730
Patch
http://drupal.org/node/1547736
Exploit
http://drupalcode.org/project/spaces.git/commitdiff/cee919c
Vendor Advisory
http://secunia.com/advisories/48930
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/05/03/1
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/05/03/2
More from Spaces
–
CVE-2013-4498
The Spaces OG submodule in the Spaces module 6.x-3.x before 6.x-3.7 for Drupal does not properly delete organic group group spaces content when using the option to move to a new…