CVE-2012-5570

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users' email addresses.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	Basic webmail module	6.x-1.x before 6.x-1.2

References

http://www.openwall.com/lists/oss-security/2012/11/20/4Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/11/27/2Mailing List, Third Party Advisory
https://drupal.org/node/1808616Release Notes, Vendor Advisory
https://www.drupal.org/node/1808852Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/11/20/4Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/11/27/2Mailing List, Third Party Advisory
https://drupal.org/node/1808616Release Notes, Vendor Advisory
https://www.drupal.org/node/1808852Vendor Advisory

Timeline

Published: Feb 8, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-55715.4A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. CVE-2012-55725.0CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary CVE-2012-55735.0The connection_edge_process_relay_cell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unexpected SENDME cell ar CVE-2012-55745.0lib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote attackers to read arbitrary files via a crafted upload request.CVE-2012-55756.4Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm CVE-2012-55767.5Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attackers to cause a denia CVE-2012-55777.5Python keyring lib before 0.10 created keyring files with world-readable permissions.CVE-2012-55786.2Python keyring has insecure permissions on new databases allowing world-readable files to be created CVE-2012-55807.5Format string vulnerability in the print_proxies function in bin/proxy.c in libproxy 0.3.1 might allow context-dependent attackers to cause CVE-2012-55816.8Stack-based buffer overflow in tif_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly e CVE-2012-55829.8opendnssec misuses libcurl API CVE-2012-55835.8phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field