CVE-2012-1645

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-08-28 · updated 2026-06-16
Weakness: CWE-200

Description

The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php.

Affected products

Wimleers Cdn: 6.x-2.2, 7.x-2.2

References

http://drupal.org/node/1441480
http://drupal.org/node/1441482
http://drupalcode.org/project/cdn.git/commitdiff/cd2a5ff
http://drupalcode.org/project/cdn.git/commitdiff/eca85e6
http://secunia.com/advisories/48032
http://www.openwall.com/lists/oss-security/2012/04/07/1
http://www.osvdb.org/79317
https://drupal.org/node/1441502
http://drupal.org/node/1441480
http://drupal.org/node/1441482
http://drupalcode.org/project/cdn.git/commitdiff/cd2a5ff
http://drupalcode.org/project/cdn.git/commitdiff/eca85e6

Get alerted when CVE-2012-1645 or the next vulnerability affects your stack