CVE-2012-5655 : The Context module 6.x-3.x before 6.x-3.1 and 7.x-3.x before 7.x-3.0-beta6 for D

The Context module 6.x-3.x before 6.x-3.1 and 7.x-3.x before 7.x-3.0-beta6 for Drupal does not properly restrict access to block content, which allows remote attackers to obtain sensitive information via a crafted request.

Published 2013-01-03 01:55:04

Updated 2013-01-07 05:00:00

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2012-5655

Steven Jones » Context » Version: 6.x-3.0 Update RC2
cpe:2.3:a:steven_jones:context:6.x-3.0:rc2:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 6.x-3.0 Update RC1
cpe:2.3:a:steven_jones:context:6.x-3.0:rc1:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 6.x-3.0 Update Beta8
cpe:2.3:a:steven_jones:context:6.x-3.0:beta8:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 6.x-3.0 Update Beta7
cpe:2.3:a:steven_jones:context:6.x-3.0:beta7:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 7.x-3.0 Update Beta1
cpe:2.3:a:steven_jones:context:7.x-3.0:beta1:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 7.x-3.x Update DEV
cpe:2.3:a:steven_jones:context:7.x-3.x:dev:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 7.x-3.0 Update Alpha3
cpe:2.3:a:steven_jones:context:7.x-3.0:alpha3:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 7.x-3.0 Update Alpha2
cpe:2.3:a:steven_jones:context:7.x-3.0:alpha2:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 6.x-3.0 Update Beta5
cpe:2.3:a:steven_jones:context:6.x-3.0:beta5:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 6.x-3.0 Update Beta3
cpe:2.3:a:steven_jones:context:6.x-3.0:beta3:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 6.x-3.0 Update Alpha1
cpe:2.3:a:steven_jones:context:6.x-3.0:alpha1:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 7.x-3.0 Update Beta4
cpe:2.3:a:steven_jones:context:7.x-3.0:beta4:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 7.x-3.0 Update Beta2
cpe:2.3:a:steven_jones:context:7.x-3.0:beta2:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 7.x-3.0 Update Alpha1
cpe:2.3:a:steven_jones:context:7.x-3.0:alpha1:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 6.x-3.0 Update Beta2
cpe:2.3:a:steven_jones:context:6.x-3.0:beta2:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 6.x-3.0 Update Beta1
cpe:2.3:a:steven_jones:context:6.x-3.0:beta1:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 6.x-3.x Update DEV
cpe:2.3:a:steven_jones:context:6.x-3.x:dev:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 6.x-3.0 Update Alpha2
cpe:2.3:a:steven_jones:context:6.x-3.0:alpha2:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 6.x-3.0
cpe:2.3:a:steven_jones:context:6.x-3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 6.x-3.0 Update Beta6
cpe:2.3:a:steven_jones:context:6.x-3.0:beta6:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 6.x-3.0 Update Beta4
cpe:2.3:a:steven_jones:context:6.x-3.0:beta4:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 7.x-3.0 Update Beta5
cpe:2.3:a:steven_jones:context:7.x-3.0:beta5:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Steven Jones » Context » Version: 7.x-3.0 Update Beta3
cpe:2.3:a:steven_jones:context:7.x-3.0:beta3:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2012-5655

EPSS FAQ

1.13%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 84 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2012-5655

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

CWE ids for CVE-2012-5655

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2012-5655

http://drupalcode.org/project/context.git/commitdiff/4452bf1

Log in | Drupal.org
Exploit;Patch
http://drupal.org/node/1870550

SA-CONTRIB-2012-174 - Context - Information Disclosure | Drupal.org
Patch;Vendor Advisory
http://www.securityfocus.com/bid/56993

Drupal Core Access Bypass and Arbitrary PHP Code Execution Vulnerabilities

CVEs referencing this url
http://drupalcode.org/project/context.git/commitdiff/d8bf8b6

Access to this page has been denied.
Patch
http://www.openwall.com/lists/oss-security/2012/12/20/1

oss-security - Re: CVE request for Drupal core, and contributed modules

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2012-5655

Products affected by CVE-2012-5655

Exploit prediction scoring system (EPSS) score for CVE-2012-5655

CVSS scores for CVE-2012-5655

CWE ids for CVE-2012-5655

References for CVE-2012-5655