CVE-2012-1645

Published: Aug 28, 2012Modified: Apr 29, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php.

Affected (2)

Products: Wimleers: Cdn

Wimleers

1 product

Cdn

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wimleers Cdn	Version 6.x-2.2
Wimleers Cdn	Version 7.x-2.2

Running on/with	Platform Versions
Drupal Drupal	All versions

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (16)

http://drupal.org/node/1441480

Source: secalert@redhat.com

http://drupal.org/node/1441482

Source: secalert@redhat.com

Patch

http://drupalcode.org/project/cdn.git/commitdiff/cd2a5ff

Source: secalert@redhat.com

Patch

http://drupalcode.org/project/cdn.git/commitdiff/eca85e6

Source: secalert@redhat.com

Patch

http://secunia.com/advisories/48032

Source: secalert@redhat.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2012/04/07/1

Source: secalert@redhat.com

http://www.osvdb.org/79317

Source: secalert@redhat.com

https://drupal.org/node/1441502

Source: secalert@redhat.com

PatchVendor Advisory

http://drupal.org/node/1441480