CVE-2012-5586
Summary
| CVE | CVE-2012-5586 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2012-12-26 17:55:02 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user profiles" permission to access arbitrary users' emails via vectors related to the "user index method" and "the path to the user resource." |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
SingleConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:H/Au:S/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Drupal | Drupal | - | All | All | All |
| Application | Marc Ingram | Services | 6.x-3.0 | All | All | All |
| Application | Marc Ingram | Services | 6.x-3.0 | alpha1 | All | All |
| Application | Marc Ingram | Services | 6.x-3.0 | beta1 | All | All |
| Application | Marc Ingram | Services | 6.x-3.0 | beta2 | All | All |
| Application | Marc Ingram | Services | 6.x-3.0 | rc1 | All | All |
| Application | Marc Ingram | Services | 6.x-3.0 | rc2 | All | All |
| Application | Marc Ingram | Services | 6.x-3.0 | rc3 | All | All |
| Application | Marc Ingram | Services | 6.x-3.0 | rc4 | All | All |
| Application | Marc Ingram | Services | 6.x-3.0 | unstable1 | All | All |
| Application | Marc Ingram | Services | 6.x-3.0 | unstable2 | All | All |
| Application | Marc Ingram | Services | 6.x-3.0 | unstable3 | All | All |
| Application | Marc Ingram | Services | 6.x-3.1 | All | All | All |
| Application | Marc Ingram | Services | 6.x-3.2 | All | All | All |
| Application | Marc Ingram | Services | 6.x-3.x | dev | All | All |
| Application | Marc Ingram | Services | 7.x-3.0 | All | All | All |
| Application | Marc Ingram | Services | 7.x-3.0 | beta1 | All | All |
| Application | Marc Ingram | Services | 7.x-3.0 | beta2 | All | All |
| Application | Marc Ingram | Services | 7.x-3.0 | rc1 | All | All |
| Application | Marc Ingram | Services | 7.x-3.0 | rc2 | All | All |
| Application | Marc Ingram | Services | 7.x-3.0 | rc3 | All | All |
| Application | Marc Ingram | Services | 7.x-3.0 | rc4 | All | All |
| Application | Marc Ingram | Services | 7.x-3.0 | rc5 | All | All |
| Application | Marc Ingram | Services | 7.x-3.0 | rc6 | All | All |
| Application | Marc Ingram | Services | 7.x-3.1 | All | All | All |
| Application | Marc Ingram | Services | 7.x-3.2 | All | All | All |
| Application | Marc Ingram | Services | 7.x-3.3 | All | All | All |
| Application | Marc Ingram | Services | 7.x-3.x | dev | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| services 7.x-3.3 | drupal.org | af854a3a-2127-422b-91ae-364da2661108 | drupal.org | Patch |
| oss-security - Re: CVE request for Drupal contributed modules | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| Drupal Services Module CVE-2012-5586 Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| SA-CONTRIB-2012-168 - Services - Information Disclosure | drupal.org | af854a3a-2127-422b-91ae-364da2661108 | drupal.org | Patch, Vendor Advisory |
| services 6.x-3.3 | drupal.org | af854a3a-2127-422b-91ae-364da2661108 | drupal.org | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.