CVE-2012-2153

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-10-01 · updated 2026-06-16
Weakness: CWE-264

Description

Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page.

Affected products

Drupal: 7.0, 7.0-alpha1, 7.0-alpha2, 7.0-alpha3, 7.0-alpha4, 7.0-alpha5 (+24)

References

http://drupal.org/drupal-7.14
http://drupal.org/node/1557938
http://drupal.org/node/1558478
http://drupalcode.org/project/drupal.git/commit/c6d2b8311b82fe78d18732f01a68ceca3dea50af
http://secunia.com/advisories/49012
http://www.mandriva.com/security/advisories?name=MDVSA-2013:074
http://www.securityfocus.com/bid/53362
http://drupal.org/drupal-7.14
http://drupal.org/node/1557938
http://drupal.org/node/1558478
http://drupalcode.org/project/drupal.git/commit/c6d2b8311b82fe78d18732f01a68ceca3dea50af
http://secunia.com/advisories/49012

Get alerted when CVE-2012-2153 or the next vulnerability affects your stack