CVE-2012-1591

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-15928.8A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and exec CVE-2012-15933.3epan/dissectors/packet-ansi_a.c in the ANSI A dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to c CVE-2012-15943.3epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.6.x before 1.6.6 allows remote attackers to cause a denial of CVE-2012-15954.3The pcap_process_pseudo_header function in wiretap/pcap-common.c in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attac CVE-2012-15965.0The mp2t_process_fragmented_payload function in epan/dissectors/packet-mp2t.c in the MP2T dissector in Wireshark 1.4.x before 1.4.12 and 1.6 CVE-2012-15972.6Cross-site scripting (XSS) vulnerability in the textEncode function in classes/ezjscajaxcontent.php in eZ JS Core in eZ Publish before 1.5 a CVE-2012-15987.5Joomla! 1.5.x before 1.5.26 has unspecified impact and attack vectors related to "insufficient randomness" and a "password reset vulnerabili CVE-2012-15995.0Joomla! 1.5.x before 1.5.26 does not properly check permissions, which allows attackers to obtain sensitive "administrative back end informa CVE-2012-16004.3Multiple cross-site scripting (XSS) vulnerabilities in functions.php in phpPgAdmin before 5.0.4 allow remote attackers to inject arbitrary w CVE-2012-16014.9The KVM implementation in the Linux kernel before 3.3.6 allows host OS users to cause a denial of service (NULL pointer dereference and host CVE-2012-16027.5user.php in NextBBS 0.6 allows remote attackers to bypass authentication and gain administrator access by setting the userkey cookie to 1.CVE-2012-16037.5Multiple SQL injection vulnerabilities in ajaxserver.php in NextBBS 0.6 allow remote attackers to execute arbitrary SQL commands via the (1)