« Back to list

CVE-2012-2720

Status: ModifiedMedium (5)—

The Token Authentication (tokenauth) module 6.x-1.x before 6.x-1.7 for Drupal does not properly revert user sessions, which might allow remote attackers to perform requests with extra privileges.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Adam Ross — Tokenauth

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2012-2720",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-06-27T00:55:04.910",
  "references": [
    {
      "url": "http://drupal.org/node/1618476",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://drupal.org/node/1619808",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/49400",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/06/14/3",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.osvdb.org/82727",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/53840",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/76141",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://drupal.org/node/1618476",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/1619808",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/49400",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/06/14/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/82727",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/53840",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/76141",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Token Authentication (tokenauth) module 6.x-1.x before 6.x-1.7 for Drupal does not properly revert user sessions, which might allow remote attackers to perform requests with extra privileges."
    },
    {
      "lang": "es",
      "value": "El token de autenticación (tokenauth) módulo v6.x-1.x anterior a v6.x-1.7 para Drupal no vuelve las sesiones de usuario correcatmente, permitiendo a atacantes remotos realizar las solicitudes con privilegios adicionales."
    }
  ],
  "lastModified": "2026-06-16T23:41:58.557",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adam_ross:tokenauth:6.x-1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "567A77F6-24C4-4583-8888-6730A61C6065"
            },
            {
              "criteria": "cpe:2.3:a:adam_ross:tokenauth:6.x-1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3DDA06E-C692-47DC-A30D-577364C11050"
            },
            {
              "criteria": "cpe:2.3:a:adam_ross:tokenauth:6.x-1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04665CA7-8F49-4B45-8095-542387849584"
            },
            {
              "criteria": "cpe:2.3:a:adam_ross:tokenauth:6.x-1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "576949CB-D444-45AE-A107-9A37FAD73DC9"
            },
            {
              "criteria": "cpe:2.3:a:adam_ross:tokenauth:6.x-1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1766143E-174E-4ADA-BD27-68F03A28A5E1"
            },
            {
              "criteria": "cpe:2.3:a:adam_ross:tokenauth:6.x-1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1DFC8E6-D300-40C5-987C-68EFD38917BF"
            },
            {
              "criteria": "cpe:2.3:a:adam_ross:tokenauth:6.x-1.x:dev:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D8A0CA6-066D-4C8A-B240-1EC3897E7F5D"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F8B1170D-AD33-4C7A-892D-63AC71B032CF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}