Vulnerability in Drupal

CVE-2012-4554

The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file.

EPSS: 0.551 (98.1th percentile) — read the EPSS interpretation.

Affected products

Drupal — versions 7.0, 7.1, 7.2
N/a — versions n/a

Weakness classification (CWE)

CWE-264

Public proof-of-concept exploits

rapid7/metasploit-framework

References

secalert@redhat.com (x_refsource_CONFIRM, Patch)
[oss-security] 20121029 CVE request: Drupal SA-CORE-2012-003 (mailing-list, x_refsource_MLIST)
secalert@redhat.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
[oss-security] 20121029 Re: CVE request: Drupal SA-CORE-2012-003 (mailing-list, x_refsource_MLIST)

Frequently asked questions

What is CVE-2012-4554?: CVE-2012-4554 is a vulnerability in Drupal, classified under CWE-264. Published 2012-11-11.
Is CVE-2012-4554 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.