CVE-2012-1590

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-10-01 · updated 2026-06-16
Weakness: CWE-264

Description

The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page.

Affected products

Drupal: 7.0, 7.0-alpha1, 7.0-alpha2, 7.0-alpha3, 7.0-alpha4, 7.0-alpha5 (+24)

References

http://drupal.org/drupal-7.14
http://drupal.org/node/1302404
http://drupal.org/node/1557938
http://drupalcode.org/project/drupal.git/commit/352645e4a636cadeb5576231b3547972eebdd8e5
http://secunia.com/advisories/49012
http://www.mandriva.com/security/advisories?name=MDVSA-2013:074
http://www.securityfocus.com/bid/53359
http://drupal.org/drupal-7.14
http://drupal.org/node/1302404
http://drupal.org/node/1557938
http://drupalcode.org/project/drupal.git/commit/352645e4a636cadeb5576231b3547972eebdd8e5
http://secunia.com/advisories/49012

Get alerted when CVE-2012-1590 or the next vulnerability affects your stack