Drupal Simplenews Module Information Disclosure Vulnerability

Bugtraq ID:	53839
Class:	Design Error
CVE:	CVE-2012-2724
Remote:	Yes
Local:	No
Published:	Jun 06 2012 12:00AM
Updated:	Aug 07 2012 08:52PM
Credit:	Laza and Sascha Grossenbacher
Vulnerable:	Drupal Simplenews 7.x-1.x Drupal Simplenews 6.x-2.x Drupal Simplenews 6.X-1.3 Drupal Simplenews 6.x-1.2 Drupal Simplenews 6.x-1.1
Not Vulnerable:	Drupal Simplenews 7.x-1.0-rc1 Drupal Simplenews 6.x-2.0-alpha4 Drupal Simplenews 6.X-1.4

Drupal Simplenews Module Information Disclosure Vulnerability

The Simplenews module for Drupal is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

The following versions are affected:

Simplenews 6.x-1.x versions prior to 6.x-1.4
Simplenews 6.x-2.x versions prior to 6.x-2.0-alpha4
Simplenews 7.x-1.x versions prior to 7.x-1.0-rc1

Drupal Simplenews Module Information Disclosure Vulnerability

Attackers can use a browser to exploit this issue.

Drupal Simplenews Module Information Disclosure Vulnerability

Solution:
Updates are available; please see the references for more information.

Drupal Simplenews Module Information Disclosure Vulnerability

References:

• Drupal Homepage (Drupal)
  
• Drupal Simplenews Module Homepage (Drupal)
  
• SA-CONTRIB-2012-095 - Simplenews - Information Disclosure (Drupal)