Vulnerability Details : CVE-2012-4554

Public exploit exists!
The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file.
Published 2012-11-11 13:00:56
Updated 2012-11-12 22:00:06
Source Red Hat, Inc.
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2012-4554

EPSS FAQ
19.11%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 96 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2012-4554

  • Drupal OpenID External Entity Injection
    Disclosure Date: 2012-10-17
    First seen: 2020-04-26
    auxiliary/gather/drupal_openid_xxe
    This module abuses an XML External Entity Injection vulnerability on the OpenID module from Drupal. The vulnerability exists in the parsing of a malformed XRDS file coming from a malicious OpenID endpoint. This module has been tested successfully on Drupal 7.15 and

CVSS scores for CVE-2012-4554

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
5.0
 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N
10.0
2.9
 NIST

CWE ids for CVE-2012-4554

  • Assigned by: nvd@nist.gov (Primary)

References for CVE-2012-4554

Products affected by CVE-2012-4554

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close