Information disclosure in Drupal

CVE-2012-5652

Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed or (2) search result.

Vulnerability class: Information Disclosure

EPSS: 0.024 (82.6th percentile) — read the EPSS interpretation.

Affected products

  • Drupal — versions 6.0, 6.1, 6.2
  • N/a — versions n/a

Weakness classification (CWE)

References