CVE-2012-5557
Estado: ModificadaBaja (3.6)—
El módulo User Read-Only v6.x-1.x antes de v6.x-1.4 y v7.x-1.x antes de v7.x-1.4 para Drupal no asigna roles adecuadamente cuando hay más de tres roles en el sitio y se dan algunas configuraciones no especificadas, lo que podría permitir a usuarios autenticados remotamente ganar privilegios a través de ciertas operaciones, como se demostró con un cambio de contraseña.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:H/Au:S/C:P/I:P/A:N
- Puntuación base: 3.6
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.43%
- Percentil entre todas las CVEs puntuadas: 72
- Fecha de la puntuación: 9/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-264
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2012-5557",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 3.6,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:N",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "HIGH",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 4.9,
"baseSeverity": "LOW",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2012-12-03T21:55:02.783",
"references": [
{
"url": "http://drupal.org/node/1840038",
"tags": [
"Patch"
],
"source": "secalert@redhat.com"
},
{
"url": "http://drupal.org/node/1840054",
"tags": [
"Patch"
],
"source": "secalert@redhat.com"
},
{
"url": "http://drupal.org/node/1840886",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "http://www.openwall.com/lists/oss-security/2012/11/20/4",
"source": "secalert@redhat.com"
},
{
"url": "http://drupal.org/node/1840038",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://drupal.org/node/1840054",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://drupal.org/node/1840886",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2012/11/20/4",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-264"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The User Read-Only module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, does not properly assign roles when there are more than three roles on the site and certain unspecified configurations, which might allow remote authenticated users to gain privileges by performing certain operations, as demonstrated by changing a password."
},
{
"lang": "es",
"value": "El módulo User Read-Only v6.x-1.x antes de v6.x-1.4 y v7.x-1.x antes de v7.x-1.4 para Drupal no asigna roles adecuadamente cuando hay más de tres roles en el sitio y se dan algunas configuraciones no especificadas, lo que podría permitir a usuarios autenticados remotamente ganar privilegios a través de ciertas operaciones, como se demostró con un cambio de contraseña."
}
],
"lastModified": "2026-06-16T23:47:00.083",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:user_read-only_project:user_readonly:6.x-1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E2C725E-8507-47EB-B885-8F951961BFDB"
},
{
"criteria": "cpe:2.3:a:user_read-only_project:user_readonly:6.x-1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F960618D-9F80-43C2-8370-35948995A897"
},
{
"criteria": "cpe:2.3:a:user_read-only_project:user_readonly:6.x-1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E75FBC3A-D9E4-45C8-946D-E03B2A13B278"
},
{
"criteria": "cpe:2.3:a:user_read-only_project:user_readonly:6.x-1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "05F92C35-CD41-40EF-98C2-969ADE48489F"
},
{
"criteria": "cpe:2.3:a:user_read-only_project:user_readonly:6.x-1.x:dev:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9DEAA6F2-1B1B-4D4B-B943-D5F3F2A0CEE1"
},
{
"criteria": "cpe:2.3:a:user_read-only_project:user_readonly:7.x-1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CDD025F4-CC12-47B9-9467-B623AA83BC20"
},
{
"criteria": "cpe:2.3:a:user_read-only_project:user_readonly:7.x-1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D1EAE089-1D8D-4C58-BF55-0718B10FE5A6"
},
{
"criteria": "cpe:2.3:a:user_read-only_project:user_readonly:7.x-1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2ACE53C3-68DF-4138-BFEE-3418177EC99A"
},
{
"criteria": "cpe:2.3:a:user_read-only_project:user_readonly:7.x-1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7380D44D-A063-4E77-B84C-0777779A4E2B"
},
{
"criteria": "cpe:2.3:a:user_read-only_project:user_readonly:7.x-1.x:dev:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CB3AD055-1133-4FBE-B4DC-A288BE6679B2"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F8B1170D-AD33-4C7A-892D-63AC71B032CF"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "secalert@redhat.com"
}