CVE-2012-5586

LowCVSS 2.1/10Last modified Jun 16, 2026

Description

The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user profiles" permission to access arbitrary users' emails via vectors related to the "user index method" and "the path to the user resource."

Metrics

CVSS 2.0 2.1/10AV:N/AC:H/Au:S/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://drupal.org/node/1842022Patch
http://drupal.org/node/1842026Patch
http://drupal.org/node/1853200Patch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/11/29/2
http://www.securityfocus.com/bid/56723
http://drupal.org/node/1842022Patch
http://drupal.org/node/1842026Patch
http://drupal.org/node/1853200Patch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/11/29/2
http://www.securityfocus.com/bid/56723

Timeline

Published: Dec 26, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-55874.3Cross-site scripting (XSS) vulnerability in the Email Field module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbit CVE-2012-55882.6The Email Field module 6.x-1.x before 6.x-1.3 for Drupal, when using a field permission module and the field contact field formatter is set CVE-2012-55893.5The MultiLink module 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal does not properly check node permissions when generating a CVE-2012-55907.5SQL injection vulnerability in the Webmail Plus module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified CVE-2012-55914.3Cross-site scripting (XSS) vulnerability in the Zero Point module 6.x-1.x before 6.x-1.18 and 7.x-1.x before 7.x-1.4 for Drupal allows remot CVE-2012-56035.5proxies_controller.rb in Katello in Red Hat CloudForms before 1.1 does not properly check permissions, which allows remote authenticated use CVE-2012-56044.3The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when using Active Directory for authentication, allows remote attackers to b CVE-2012-56053.3A flaw was found in Grinder, a component of Red Hat CloudForms. This vulnerability allows a local user to modify Grinder's cache files due t CVE-2012-56064.3Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script CVE-2012-56075.0The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote a CVE-2012-56084.3Cross-site scripting (XSS) vulnerability in apps/user_webdavauth/settings.php in ownCloud 4.5.x before 4.5.2 allows remote attackers to inje CVE-2012-56096.5Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP co