CVE-2012-1591

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-10-01 · updated 2026-06-16
Weakness: CWE-264

Description

The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.

Affected products

Drupal: 7.0, 7.0-alpha1, 7.0-alpha2, 7.0-alpha3, 7.0-alpha4, 7.0-alpha5 (+24)

References

http://drupal.org/drupal-7.14
http://drupal.org/node/1507988
http://drupal.org/node/1557938
http://drupalcode.org/project/drupal.git/commit/3bf6761ff7537dc68e22ea73f155134f3cfd41a8
http://secunia.com/advisories/49012
http://www.mandriva.com/security/advisories?name=MDVSA-2013:074
http://www.securityfocus.com/bid/53359
http://drupal.org/drupal-7.14
http://drupal.org/node/1507988
http://drupal.org/node/1557938
http://drupalcode.org/project/drupal.git/commit/3bf6761ff7537dc68e22ea73f155134f3cfd41a8
http://secunia.com/advisories/49012

Get alerted when CVE-2012-1591 or the next vulnerability affects your stack