CVE-2012-1591
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching...
CVE-2012-1591 is a medium vulnerability (CVSS 5.0) in Drupal, published October 1, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.40%, the 84th percentile. No source names a fixed version.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 2.40%EPSS, 84th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
Exploit likelihood
Affected products
What each source reports
NVD Score used
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
- Record
CVE-2012-1591- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
- Record
CVE-2012-1591- Updated
- 2026-11-02
EUVDEUVD-2012-1606No score
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
- Record
EUVD-2012-1606- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x6x4-j89w-cw4wNo score
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching...
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
- Record
GHSA-x6x4-j89w-cw4w- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
drupal.org/node/1507988
securityfocus.com/bid/53359
mandriva.com/security/advisories?name=MDVSA-2013:074
secunia.com/advisories/49012
drupalcode.org/project/drupal.git/commit/3bf6761ff7537dc68e22ea73f155134f3cfd41a8
nvd.nist.gov/vuln/detail/CVE-2012-1591
github.com/advisories/GHSA-x6x4-j89w-cw4w