CVE-2012-1650
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead...
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
Exploit likelihood
What each source reports
NVD Score used
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
- Record
CVE-2012-1650- CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
- Record
CVE-2012-1650- Updated
- 2026-11-02
EUVDEUVD-2012-1660 No score
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
- Record
EUVD-2012-1660- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j4cx-8j85-q6qg No score
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead...
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
- Record
GHSA-j4cx-8j85-q6qg- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-1650 is a medium vulnerability (CVSS 6.0) in Giantrobot Zipcart, published August 28, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. No source names a fixed version.
References
drupalcode.org/project/zipcart.git/commitdiff/fe143c2
drupal.org/node/1461446
osvdb.org/79766
openwall.com/lists/oss-security/2012/04/07/1
exchange.xforce.ibmcloud.com/vulnerabilities/73609
securityfocus.com/bid/52231
nvd.nist.gov/vuln/detail/CVE-2012-1650
github.com/advisories/GHSA-j4cx-8j85-q6qg