CVE-2012-5651

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-01-03 · updated 2026-06-16
Weakness: CWE-264

Description

Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might allow remote attackers to obtain sensitive information by reading the search results.

Affected products

Drupal: 6.0, 6.0-beta1, 6.0-beta2, 6.0-beta3, 6.0-beta4, 6.0-dev (+64)

References

http://drupal.org/SA-CORE-2012-004
http://drupalcode.org/project/drupal.git/commitdiff/b47f95d
http://drupalcode.org/project/drupal.git/commitdiff/da8023a
http://www.debian.org/security/2013/dsa-2776
http://www.mandriva.com/security/advisories?name=MDVSA-2013:074
http://www.openwall.com/lists/oss-security/2012/12/20/1
http://www.osvdb.org/88528
http://www.securityfocus.com/bid/56993
https://exchange.xforce.ibmcloud.com/vulnerabilities/80792
http://drupal.org/SA-CORE-2012-004
http://drupalcode.org/project/drupal.git/commitdiff/b47f95d
http://drupalcode.org/project/drupal.git/commitdiff/da8023a

Get alerted when CVE-2012-5651 or the next vulnerability affects your stack