CVE-2012-2153
Drupal improper access restrictions
Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page.
Exploit likelihood
What each source reports
NVD Score used
Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page.
- Record
CVE-2012-2153- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page.
- Record
CVE-2012-2153- Updated
- 2026-11-02
EUVDEUVD-2022-5396 No score
Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page.
- Record
EUVD-2022-5396- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vpm6-h53m-x2xf No score
Drupal improper access restrictions
Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page.
- Record
GHSA-vpm6-h53m-x2xf- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-vpm6-h53m-x2xf No score
Drupal improper access restrictions
Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page.
- Record
GHSA-vpm6-h53m-x2xf- Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/drupalPackagist |
7.0 up to 7.14 | 7.14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-2153 is a medium vulnerability (CVSS 4.0) in Drupal, published October 1, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in drupal/drupal 7.14.
References
securityfocus.com/bid/53362
drupal.org/drupal-7.14
drupalcode.org/project/drupal.git/commit/c6d2b8311b82fe78d18732f01a68ceca3dea50af
mandriva.com/security/advisories?name=MDVSA-2013:074
secunia.com/advisories/49012
Show 5 moreShow less
nvd.nist.gov/vuln/detail/CVE-2012-2153
web.archive.org/web/20150523060428/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:074?name=MDVSA-2013:074
github.com/advisories/GHSA-vpm6-h53m-x2xf