Description

Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might allow remote attackers to obtain sensitive information by reading the search results.

Remediation

References

CVE-2012-5651

Related Vulnerabilities

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-5022)

Chamilo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-31801)

Drupal Improper Authentication Vulnerability (CVE-2006-1228)

WordPress Plugin WP RSS Aggregator-News Feeds, Autoblogging, Youtube Video Feeds and More Cross-Site Scripting (4.19.2)

Atlassian Jira Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-20411)

Severity

Medium

Classification

CVE-2012-5651 CWE-264

Tags

Missing Update Known Vulnerabilities