CVE-2012-1635

Estado: ModificadaMedia (6.4)—

The hook_node_access function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks the permissions of the current user even when it is called to check permissions of other users, which allows remote attackers to bypass intended access restrictions, as demonstrated when using the XML sitemap module to obtain sensitive information about unpublished content.

CVSS

Versión: 2.0
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Puntuación base: 6.4

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.36%
Percentil entre todas las CVEs puntuadas: 71
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

RIK DE Boer — Revisioning

CWE

CWE-264

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2012-1635",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-08-28T17:55:01.407",
  "references": [
    {
      "url": "http://drupal.org/node/1407456",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/04/07/1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://drupal.org/node/1409268",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://drupal.org/node/1407456",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/04/07/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://drupal.org/node/1409268",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The hook_node_access function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks the permissions of the current user even when it is called to check permissions of other users, which allows remote attackers to bypass intended access restrictions, as demonstrated when using the XML sitemap module to obtain sensitive information about unpublished content."
    },
    {
      "lang": "es",
      "value": "La funcion hook_node_access en el módulo revisioning v7.x-1.x anterior a v7.x-1.3 para Drupal comprueba los permisos del usuario actual, incluso cuando se le llama para comprobar los permisos de otros usuarios, lo que permite a atacantes remotos evitar las restricciones de acceso, como se demuestra cuando se utiliza el módulo XML Sitemap para obtener información sensible acerca del contenido publicado."
    }
  ],
  "lastModified": "2026-06-16T23:39:56.060",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF52E04C-FA27-4A40-8C65-E3195EFDDBAD"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB103093-A42E-42BF-99F6-87E7CFC8B202"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B3FBBCE5-CBE9-44C2-968B-4AC9C3C9BEFE"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:alpha3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BB069EF-CF7C-4E09-A710-C3526E0439B9"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:alpha4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39C15145-C442-4DB1-944D-8CAC20D475C6"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:alpha5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5499411-30C0-49AE-A86A-0CAE4776EEC0"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "050AE8CD-38A6-422F-BF37-91562EBA1753"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2126DE43-B110-4091-BF89-89B19A65FFC8"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39A44978-D60E-4BC8-8686-D37DB1A11E8B"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88A49A47-BED7-4316-BDB0-B861AF4ACF1A"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DFD9AD40-89F5-45AE-B4A5-090F39E510E0"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFCF6DBC-9791-424B-BC65-DC5C990F9C83"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05AEB8FF-3D71-43F0-B315-B85A8088B45B"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE0BAD57-71F6-4D5C-B586-9BFF96A6538C"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7CD6834-3118-4609-8F30-3D539DE57F12"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B10F2925-F3D6-4221-8925-92D1DD9CA6F0"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.0:beta9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "437992A2-01B5-4A8C-ABE5-3E7E575FA19F"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA56AC18-8534-4A52-8DA8-1295BD42FC77"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F878269-B46B-4FF1-9064-8418878C3716"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.x:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83906B05-3E19-4B71-994A-2EBCB8792074"
            },
            {
              "criteria": "cpe:2.3:a:rik_de_boer:revisioning:7.x-1.x:dev:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AEFC2CF-4875-45FC-836A-A7B273CDAE1F"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F8B1170D-AD33-4C7A-892D-63AC71B032CF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}