CVE-2012-1650
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead...
CVE-2012-1650 is a medium vulnerability (CVSS 6.0) in Giantrobot Zipcart, published August 28, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. No source names a fixed version.
- Severity
- 6.0 MediumCVSS 2.0, NVD
- Exploit chance
- 1.20%EPSS, 68th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
Exploit likelihood
Affected products
What each source reports
NVD Score used
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
- Record
CVE-2012-1650- CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
- Record
CVE-2012-1650- Updated
- 2026-11-02
EUVDEUVD-2012-1660No score
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
- Record
EUVD-2012-1660- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j4cx-8j85-q6qgNo score
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead...
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
- Record
GHSA-j4cx-8j85-q6qg- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
drupalcode.org/project/zipcart.git/commitdiff/fe143c2
drupal.org/node/1461446
osvdb.org/79766
openwall.com/lists/oss-security/2012/04/07/1
exchange.xforce.ibmcloud.com/vulnerabilities/73609
securityfocus.com/bid/52231
nvd.nist.gov/vuln/detail/CVE-2012-1650
github.com/advisories/GHSA-j4cx-8j85-q6qg