« Volver al listado

CVE-2012-4495

Estado: ModificadaMedia (4)—

The Mime Mail module 6.x-1.x before 6.x-1.1 for Drupal does not properly restrict access to files outside Drupal's publish files directory, which allows remote authenticated users to send arbitrary files as attachments.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mime Mail Module Project — Mimemail

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-4495",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-10-31T16:55:03.497",
  "references": [
    {
      "url": "http://drupal.org/node/1719446",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://drupal.org/node/1719482",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://drupalcode.org/project/mimemail.git/commitdiff/ae065d1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/10/04/6",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/10/07/1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/54914",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://drupal.org/node/1719446",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/1719482",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupalcode.org/project/mimemail.git/commitdiff/ae065d1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/10/04/6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/10/07/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/54914",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Mime Mail module 6.x-1.x before 6.x-1.1 for Drupal does not properly restrict access to files outside Drupal's publish files directory, which allows remote authenticated users to send arbitrary files as attachments."
    },
    {
      "lang": "es",
      "value": "El módulo Mime Mail v6.x-1.x antes de v6.x-1.1 para Drupal no restringe correctamente el acceso a archivos fuera de los directorios de archivos publicados de Drupal, lo que permite a usuarios autenticados remotamente enviar archivos arbitrarios como adjuntos."
    }
  ],
  "lastModified": "2026-06-16T23:45:12.337",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mime_mail_module_project:mimemail:6.x-1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D180F48-3B26-401D-94A3-51ACCC64AA2F"
            },
            {
              "criteria": "cpe:2.3:a:mime_mail_module_project:mimemail:6.x-1.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A7E9582-03A6-46D0-AF7B-26B8A2F9D145"
            },
            {
              "criteria": "cpe:2.3:a:mime_mail_module_project:mimemail:6.x-1.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16797785-5637-4016-9291-F634670D6C87"
            },
            {
              "criteria": "cpe:2.3:a:mime_mail_module_project:mimemail:6.x-1.0:alpha3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E40AA45-EF97-4472-9316-82EB6F0A5DF6"
            },
            {
              "criteria": "cpe:2.3:a:mime_mail_module_project:mimemail:6.x-1.0:alpha4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F79D255A-B5F1-4FF4-81D6-B203A9A157AD"
            },
            {
              "criteria": "cpe:2.3:a:mime_mail_module_project:mimemail:6.x-1.0:alpha5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80EAD136-8383-4DDC-AF29-B955524C8B15"
            },
            {
              "criteria": "cpe:2.3:a:mime_mail_module_project:mimemail:6.x-1.0:alpha6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10C63D10-EC82-4F31-AF99-5F55F10C4C37"
            },
            {
              "criteria": "cpe:2.3:a:mime_mail_module_project:mimemail:6.x-1.0:alpha7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "588C1F9B-16C0-4357-8140-63D8E120FD97"
            },
            {
              "criteria": "cpe:2.3:a:mime_mail_module_project:mimemail:6.x-1.0:alpha8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6CBC4EE2-9D24-4548-B607-1C20B24461AA"
            },
            {
              "criteria": "cpe:2.3:a:mime_mail_module_project:mimemail:6.x-1.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BB49651-DF69-49F8-AE0B-2CDF553B170D"
            },
            {
              "criteria": "cpe:2.3:a:mime_mail_module_project:mimemail:6.x-1.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2372E7EA-5E1F-4F5D-9806-2A194B467626"
            },
            {
              "criteria": "cpe:2.3:a:mime_mail_module_project:mimemail:6.x-1.x:dev:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEBBBE60-8DE6-4270-BCCE-235CA013754B"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F8B1170D-AD33-4C7A-892D-63AC71B032CF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}