CVE-2012-2730

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The Protected Node module 6.x-1.x before 6.x-1.6 for Drupal does not properly "protect node access when nodes are accessed outside of the standard node view," which allows remote attackers to bypass intended access restrictions.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://drupal.org/node/1258034Patch
http://drupal.org/node/1632918Patch, Vendor Advisory
http://secunia.com/advisories/49509Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/06/14/3
http://www.osvdb.org/82984
http://www.securityfocus.com/bid/54001
https://exchange.xforce.ibmcloud.com/vulnerabilities/76291
http://drupal.org/node/1258034Patch
http://drupal.org/node/1632918Patch, Vendor Advisory
http://secunia.com/advisories/49509Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/06/14/3
http://www.osvdb.org/82984
http://www.securityfocus.com/bid/54001
https://exchange.xforce.ibmcloud.com/vulnerabilities/76291

Timeline

Published: Jun 27, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-27312.6The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which mig CVE-2012-27335.0java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 CVE-2012-27346.8Multiple cross-site request forgery (CSRF) vulnerabilities in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and CVE-2012-27354.9Session fixation vulnerability in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remot CVE-2012-27364.4In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network CVE-2012-27371.9The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check th CVE-2012-27384.0The VteTerminal in gnome-terminal (vte) before 0.32.2 allows remote authenticated users to cause a denial of service (long loop and CPU cons CVE-2012-27395.0Oracle Java SE before 7 Update 6, and OpenJDK 7 before 7u6 build 12 and 8 before build 39, computes hash values without restricting the abil CVE-2012-27407.5SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands v CVE-2012-27414.3Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary w CVE-2012-27425.0Revelation 0.4.13-2 and earlier uses only the first 32 characters of a password followed by a sequence of zeros, which reduces the entropy a CVE-2012-27435.0Revelation 0.4.13-2 and earlier does not iterate through SHA hashing algorithms for AES encryption, which makes it easier for context-depend