CVE-2012-2303

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-07-18 · updated 2026-06-16
Weakness: CWE-264

Description

The Spaces module 6.x-3.x before 6.x-3.4 for Drupal does not enforce permissions on non-object pages, which allows remote attackers to obtain sensitive information and possibly have other impacts via unspecified vectors to the (1) Spaces or (2) Spaces OG module.

Affected products

Florian Weber Spaces: 6.x-3.0, 6.x-3.0-alpha1, 6.x-3.0-alpha2, 6.x-3.0-beta1, 6.x-3.0-beta2, 6.x-3.0-beta3 (+8)

References

http://drupal.org/node/1547730
http://drupal.org/node/1547736
http://drupalcode.org/project/spaces.git/commitdiff/cee919c
http://secunia.com/advisories/48930
http://www.openwall.com/lists/oss-security/2012/05/03/1
http://www.openwall.com/lists/oss-security/2012/05/03/2
http://www.osvdb.org/81556
http://www.securityfocus.com/bid/53252
http://drupal.org/node/1547730
http://drupal.org/node/1547736
http://drupalcode.org/project/spaces.git/commitdiff/cee919c
http://secunia.com/advisories/48930

Get alerted when CVE-2012-2303 or the next vulnerability affects your stack