CVE-2012-2724

MediumCVSS 5.3/10Last modified Jun 16, 2026

Description

The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allows remote attackers to obtain sensitive information via the confirmation page.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Simplenews	Simplenews	6.x-1.x before 6.x-1.4; 6.x-2.x before 6.x-2.0-alpha4; and 7.x-1.x before 7.x-1.0-rc1

References

http://drupal.org/node/1619812Third Party Advisory
http://drupal.org/node/1619818Third Party Advisory
http://drupal.org/node/1619820Third Party Advisory
http://drupal.org/node/1619848Third Party Advisory
http://drupalcode.org/project/simplenews.git/commitdiff/36352c1Permissions Required, Third Party Advisory
http://drupalcode.org/project/simplenews.git/commitdiff/6d5704cPermissions Required, Third Party Advisory
http://drupalcode.org/project/simplenews.git/commitdiff/faec6a6Permissions Required, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/06/14/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/53839Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/76143Third Party Advisory, VDB Entry
http://drupal.org/node/1619812Third Party Advisory
http://drupal.org/node/1619818Third Party Advisory
http://drupal.org/node/1619820Third Party Advisory
http://drupal.org/node/1619848Third Party Advisory
http://drupalcode.org/project/simplenews.git/commitdiff/36352c1Permissions Required, Third Party Advisory
http://drupalcode.org/project/simplenews.git/commitdiff/6d5704cPermissions Required, Third Party Advisory
http://drupalcode.org/project/simplenews.git/commitdiff/faec6a6Permissions Required, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/06/14/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/53839Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/76143Third Party Advisory, VDB Entry

Timeline

Published: Jan 9, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-27253.5classes/Filter/WhitelistedExternalFilter.php in the Authoring HTML module 6.x-1.x before 6.x-1.1 for Drupal does not properly validate sourc CVE-2012-27262.1Cross-site scripting (XSS) vulnerability in the Protest module 6.x-1.x before 6.x-1.2 or 7.x-1.x before 7.x-1.2 for Drupal allows remote aut CVE-2012-27275.8Open redirect vulnerability in the Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when synchronizing user data, allows remote attack CVE-2012-27286.8Multiple cross-site request forgery (CSRF) vulnerabilities in the Node Hierarchy module 6.x-1.x before 6.x-1.5 for Drupal allow remote attac CVE-2012-27296.8Multiple cross-site request forgery (CSRF) vulnerabilities in the SimpleMeta module 6.x-1.x before 6.x-2.0 for Drupal allow remote attackers CVE-2012-27307.5The Protected Node module 6.x-1.x before 6.x-1.6 for Drupal does not properly "protect node access when nodes are accessed outside of the st CVE-2012-27312.6The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which mig CVE-2012-27335.0java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 CVE-2012-27346.8Multiple cross-site request forgery (CSRF) vulnerabilities in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and CVE-2012-27354.9Session fixation vulnerability in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remot CVE-2012-27364.4In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network CVE-2012-27371.9The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check th