CVE-2012-5557
The User Read-Only module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, does not properly assign roles when there are more than three roles on the site and certain unspecified configurations, which might allow remote authenticated users…
Does this matter?
Lower severity and a low EPSS score (1.43%). Track it; it rarely justifies an emergency change on its own.
Description
The User Read-Only module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, does not properly assign roles when there are more than three roles on the site and certain unspecified configurations, which might allow remote authenticated users to gain privileges by performing certain operations, as demonstrated by changing a password.
- CVSS 2.0
- 3.6 LOWAV:N/AC:H/Au:S/C:P/I:P/A:N
- EPSS
- 1.43% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- user read-only project/user readonly
- Source
- secalert@redhat.com
References
- http://drupal.org/node/1840038Patch
- http://drupal.org/node/1840054Patch
- http://drupal.org/node/1840886Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/11/20/4
- http://drupal.org/node/1840038Patch
- http://drupal.org/node/1840054Patch
- http://drupal.org/node/1840886Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/11/20/4
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.