« Volver al listado

CVE-2012-2720

Estado: ModificadaMedia (5)—

The Token Authentication (tokenauth) module 6.x-1.x before 6.x-1.7 for Drupal does not properly revert user sessions, which might allow remote attackers to perform requests with extra privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Adam Ross — Tokenauth

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-2720",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-06-27T00:55:04.910",
  "references": [
    {
      "url": "http://drupal.org/node/1618476",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://drupal.org/node/1619808",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/49400",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/06/14/3",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.osvdb.org/82727",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/53840",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/76141",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://drupal.org/node/1618476",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/1619808",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/49400",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/06/14/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/82727",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/53840",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/76141",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Token Authentication (tokenauth) module 6.x-1.x before 6.x-1.7 for Drupal does not properly revert user sessions, which might allow remote attackers to perform requests with extra privileges."
    },
    {
      "lang": "es",
      "value": "El token de autenticación (tokenauth) módulo v6.x-1.x anterior a v6.x-1.7 para Drupal no vuelve las sesiones de usuario correcatmente, permitiendo a atacantes remotos realizar las solicitudes con privilegios adicionales."
    }
  ],
  "lastModified": "2026-06-16T23:41:58.557",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adam_ross:tokenauth:6.x-1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "567A77F6-24C4-4583-8888-6730A61C6065"
            },
            {
              "criteria": "cpe:2.3:a:adam_ross:tokenauth:6.x-1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3DDA06E-C692-47DC-A30D-577364C11050"
            },
            {
              "criteria": "cpe:2.3:a:adam_ross:tokenauth:6.x-1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04665CA7-8F49-4B45-8095-542387849584"
            },
            {
              "criteria": "cpe:2.3:a:adam_ross:tokenauth:6.x-1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "576949CB-D444-45AE-A107-9A37FAD73DC9"
            },
            {
              "criteria": "cpe:2.3:a:adam_ross:tokenauth:6.x-1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1766143E-174E-4ADA-BD27-68F03A28A5E1"
            },
            {
              "criteria": "cpe:2.3:a:adam_ross:tokenauth:6.x-1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1DFC8E6-D300-40C5-987C-68EFD38917BF"
            },
            {
              "criteria": "cpe:2.3:a:adam_ross:tokenauth:6.x-1.x:dev:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D8A0CA6-066D-4C8A-B240-1EC3897E7F5D"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F8B1170D-AD33-4C7A-892D-63AC71B032CF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}