Description

Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might allow remote attackers to obtain sensitive information by reading the search results.

Remediation

References

CVE-2012-5651

Related Vulnerabilities

XWiki Weak Password Recovery Mechanism for Forgotten Password Vulnerability (CVE-2022-23619)

Ruby on Rails Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2014-7829)

Apache Traffic Server Improper Input Validation Vulnerability (CVE-2022-31780)

WordPress Plugin Events Shortcodes For The Events Calendar Unspecified Vulnerability (1.7.2)

WordPress Plugin NextGEN Gallery-WordPress Gallery Privilege Escalation (3.2.2)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2012-5651