VulnerabilityModified
CVE-2012-1645
The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php.
LOW 2.6EPSS 1.40%
Does this matter?
Lower severity and a low EPSS score (1.40%). Track it; it rarely justifies an emergency change on its own.
Description
The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php.
- CVSS 2.0
- 2.6 LOWAV:N/AC:H/Au:N/C:P/I:N/A:N
- EPSS
- 1.40% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- wimleers/cdn
- Source
- secalert@redhat.com
References
- http://drupal.org/node/1441480
- http://drupal.org/node/1441482Patch
- http://drupalcode.org/project/cdn.git/commitdiff/cd2a5ffPatch
- http://drupalcode.org/project/cdn.git/commitdiff/eca85e6Patch
- http://secunia.com/advisories/48032Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/04/07/1
- http://www.osvdb.org/79317
- https://drupal.org/node/1441502Patch, Vendor Advisory
- http://drupal.org/node/1441480
- http://drupal.org/node/1441482Patch
- http://drupalcode.org/project/cdn.git/commitdiff/cd2a5ffPatch
- http://drupalcode.org/project/cdn.git/commitdiff/eca85e6Patch
- http://secunia.com/advisories/48032Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/04/07/1
- http://www.osvdb.org/79317
- https://drupal.org/node/1441502Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.