VulnerabilityModified
CVE-2012-2073
The Bundle copy module 7.x-1.x before 7.x-1.1 for Drupal does not check for the "use PHP for settings" permission while importing settings, which allows remote authenticated users with certain permissions to execute arbitrary PHP code via unspecified…
MEDIUM 6.0EPSS 1.82%
Does this matter?
Lower severity and a low EPSS score (1.82%). Track it; it rarely justifies an emergency change on its own.
Description
The Bundle copy module 7.x-1.x before 7.x-1.1 for Drupal does not check for the "use PHP for settings" permission while importing settings, which allows remote authenticated users with certain permissions to execute arbitrary PHP code via unspecified vectors.
- CVSS 2.0
- 6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
- EPSS
- 1.82% probability · 78th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- kristof de jaeger/bundle copy
- Source
- secalert@redhat.com
References
- http://drupal.org/node/1506166Patch
- http://drupal.org/node/1506420Patch, Vendor Advisory
- http://drupalcode.org/project/bundle_copy.git/commit/299bdca
- http://osvdb.org/80676
- http://secunia.com/advisories/48626Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/04/07/1
- http://www.securityfocus.com/bid/52811
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74439
- http://drupal.org/node/1506166Patch
- http://drupal.org/node/1506420Patch, Vendor Advisory
- http://drupalcode.org/project/bundle_copy.git/commit/299bdca
- http://osvdb.org/80676
- http://secunia.com/advisories/48626Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/04/07/1
- http://www.securityfocus.com/bid/52811
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74439
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.