CVE-2012-5586

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-12-26 · updated 2026-06-16
Weakness: CWE-264

Description

The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user profiles" permission to access arbitrary users' emails via vectors related to the "user index method" and "the path to the user resource."

Affected products

Marc Ingram Services: 6.x-3.0, 6.x-3.0-alpha1, 6.x-3.0-beta1, 6.x-3.0-beta2, 6.x-3.0-rc1, 6.x-3.0-rc2 (+21)

References

http://drupal.org/node/1842022
http://drupal.org/node/1842026
http://drupal.org/node/1853200
http://www.openwall.com/lists/oss-security/2012/11/29/2
http://www.securityfocus.com/bid/56723
http://drupal.org/node/1842022
http://drupal.org/node/1842026
http://drupal.org/node/1853200
http://www.openwall.com/lists/oss-security/2012/11/29/2
http://www.securityfocus.com/bid/56723

Get alerted when CVE-2012-5586 or the next vulnerability affects your stack