CVE-2012-2304

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

The Linkit module 7.x-2.x before 7.x-2.3 for Drupal, when using an entity access module, does not check permissions when searching for entities, which allows remote attackers to obtain sensitive information via unspecified vectors.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Aug 14, 2012
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2012

CVE-2012-23056.8Cross-site request forgery (CSRF) vulnerability in the Node Gallery module for Drupal 6.x-3.1 and earlier allows remote attackers to hijack CVE-2012-23067.5SQL injection vulnerability in the Addressbook module for Drupal 6.x-4.2 and earlier allows remote attackers to execute arbitrary SQL commanCVE-2012-23076.8Cross-site request forgery (CSRF) vulnerability in the Addressbook module for Drupal 6.x-4.2 and earlier allows remote attackers to hijack tCVE-2012-23083.5Cross-site scripting (XSS) vulnerability in the Taxonomy Grid : Catalog module for Drupal 6.x-1.6 and earlier allows remote authenticated usCVE-2012-23093.5Cross-site scripting (XSS) vulnerability in the Glossify Internal Links Auto SEO module for Drupal 6.x-2.5 and earlier allows remote authentCVE-2012-23103.5Cross-site scripting (XSS) vulnerability in the cctags module for Drupal 6.x-1.x before 6.x-1.10 and 7.x-1.x before 7.x-1.10 allows remote aCVE-2012-23117.5sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle queCVE-2012-23127.8An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, CVE-2012-23131.2The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG comCVE-2012-23142.1The bootloader configuration module (pyanaconda/bootloader.py) in Anaconda uses 755 permissions for /etc/grub.d, which allows local users toCVE-2012-23154.0admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remoCVE-2012-23166.8Cross-site request forgery (CSRF) vulnerability in servlet/admin/AuthServlet.java in OpenKM 5.1.7 and other versions before 5.1.8-2 allows r
CVE-2012-2304: Medium severity, CVSS 4.3 | Vulnix