CVE-2012-1590
The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished...
The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page.
Exploit likelihood
What each source reports
NVD Score used
The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page.
- Record
CVE-2012-1590- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page.
- Record
CVE-2012-1590- Updated
- 2026-11-02
EUVDEUVD-2012-1605 No score
The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page.
- Record
EUVD-2012-1605- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pp4m-6679-4g83 No score
The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished...
The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page.
- Record
GHSA-pp4m-6679-4g83- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-1590 is a medium vulnerability (CVSS 4.0) in Drupal, published October 1, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.36%, the 71st percentile. No source names a fixed version.
References
drupal.org/drupal-7.14
securityfocus.com/bid/53359
mandriva.com/security/advisories?name=MDVSA-2013:074
secunia.com/advisories/49012
drupalcode.org/project/drupal.git/commit/352645e4a636cadeb5576231b3547972eebdd8e5
nvd.nist.gov/vuln/detail/CVE-2012-1590
github.com/advisories/GHSA-pp4m-6679-4g83