VulnerabilityModified
CVE-2012-2724
The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allows remote attackers to obtain…
MEDIUM 5.3EPSS 2.45%
Does this matter?
Lower severity and a low EPSS score (2.45%). Track it; it rarely justifies an emergency change on its own.
Description
The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allows remote attackers to obtain sensitive information via the confirmation page.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 2.45% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- md-systems/simplenews
- Source
- secalert@redhat.com
References
- http://drupal.org/node/1619812Third Party Advisory
- http://drupal.org/node/1619818Third Party Advisory
- http://drupal.org/node/1619820Third Party Advisory
- http://drupal.org/node/1619848Third Party Advisory
- http://drupalcode.org/project/simplenews.git/commitdiff/36352c1Permissions Required, Third Party Advisory
- http://drupalcode.org/project/simplenews.git/commitdiff/6d5704cPermissions Required, Third Party Advisory
- http://drupalcode.org/project/simplenews.git/commitdiff/faec6a6Permissions Required, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2012/06/14/3Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/53839Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76143Third Party Advisory, VDB Entry
- http://drupal.org/node/1619812Third Party Advisory
- http://drupal.org/node/1619818Third Party Advisory
- http://drupal.org/node/1619820Third Party Advisory
- http://drupal.org/node/1619848Third Party Advisory
- http://drupalcode.org/project/simplenews.git/commitdiff/36352c1Permissions Required, Third Party Advisory
- http://drupalcode.org/project/simplenews.git/commitdiff/6d5704cPermissions Required, Third Party Advisory
- http://drupalcode.org/project/simplenews.git/commitdiff/faec6a6Permissions Required, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2012/06/14/3Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/53839Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76143Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.