CVE-2012-1591
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching...
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
Exploit likelihood
What each source reports
NVD Score used
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
- Record
CVE-2012-1591- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
- Record
CVE-2012-1591- Updated
- 2026-11-02
EUVDEUVD-2012-1606 No score
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
- Record
EUVD-2012-1606- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x6x4-j89w-cw4w No score
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching...
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
- Record
GHSA-x6x4-j89w-cw4w- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-1591 is a medium vulnerability (CVSS 5.0) in Drupal, published October 1, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.40%, the 84th percentile. No source names a fixed version.
References
drupal.org/node/1507988
securityfocus.com/bid/53359
mandriva.com/security/advisories?name=MDVSA-2013:074
secunia.com/advisories/49012
drupalcode.org/project/drupal.git/commit/3bf6761ff7537dc68e22ea73f155134f3cfd41a8
nvd.nist.gov/vuln/detail/CVE-2012-1591
github.com/advisories/GHSA-x6x4-j89w-cw4w