CVE-2012-1650

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-08-28 · updated 2026-06-16
Weakness: CWE-264

Description

The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.

Affected products

Giantrobot Zipcart: 6.x-1.2, 6.x-1.3, 6.x-1.x-dev

References

http://drupalcode.org/project/zipcart.git/commitdiff/fe143c2
http://www.openwall.com/lists/oss-security/2012/04/07/1
http://www.osvdb.org/79766
http://www.securityfocus.com/bid/52231
https://drupal.org/node/1460892
https://drupal.org/node/1461446
https://exchange.xforce.ibmcloud.com/vulnerabilities/73609
http://drupalcode.org/project/zipcart.git/commitdiff/fe143c2
http://www.openwall.com/lists/oss-security/2012/04/07/1
http://www.osvdb.org/79766
http://www.securityfocus.com/bid/52231
https://drupal.org/node/1460892

Get alerted when CVE-2012-1650 or the next vulnerability affects your stack