{"id":"CVE-2012-0825","aliases":["DSA-2776-1","EUVD-2012-0851","GHSA-9f2c-79x6-jgvf"],"status":"published","title":"Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX)...","description":"Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01979,"percentile":0.80656,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2013-10-11T00:00:00Z","modified":"2026-06-16T23:38:20Z","affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"drupal6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.28-1"}]}],"versions":["6.18-1","6.18-1squeeze1","6.20-1","6.20-1~bpo50+1","6.20-1~bpo60+1","6.20-2","6.22-1","6.22-1~bpo60+1","6.26-1","6.26-1.1","6.26-1~bpo60+1"],"bundled":7}],"products":[{"vendor":"drupal","product":"drupal"}],"references":[{"url":"https://drupal.org/node/1425084","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://openid.net/2011/05/05/attribute-exchange-security-alert/","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.debian.org/security/2013/dsa-2776","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0825"},{"url":"http://openid.net/2011/05/05/attribute-exchange-security-alert"},{"url":"https://github.com/advisories/GHSA-9f2c-79x6-jgvf"}],"sources":{"cve":[{"id":"CVE-2012-0825","description":"Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.","status":"published","published":"2013-10-28T22:00:00Z","modified":"2024-08-06T18:38:14.857Z","updated_at":"2026-11-02T14:34:52.981189Z"}],"euvd":[{"id":"EUVD-2012-0851","description":"Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.","status":"published","published":"2013-10-28T22:00:00Z","modified":"2024-08-06T18:38:14Z","updated_at":"2026-11-03T01:56:19.818597Z"}],"ghsa":[{"id":"GHSA-9f2c-79x6-jgvf","title":"Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX)...","description":"Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.","status":"published","published":"2022-05-17T04:50:16Z","modified":"2025-04-11T04:16:34Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:01:14.923786Z"}],"nvd":[{"id":"CVE-2012-0825","description":"Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.","status":"published","published":"2013-10-28T22:55:03.383Z","modified":"2026-06-16T23:38:20.133Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:17.375282Z"}],"osv":[{"id":"DSA-2776-1","title":"drupal6 - several","status":"published","published":"2013-10-11T00:00:00Z","modified":"2026-03-09T01:22:04.325626Z","updated_at":"2026-11-02T15:46:15.489951Z"}]}}