CVE-2012-1645

Description

The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php.

References

https://drupal.org/node/1441502

http://www.osvdb.org/79317

http://www.openwall.com/lists/oss-security/2012/04/07/1

http://secunia.com/advisories/48032

http://drupalcode.org/project/cdn.git/commitdiff/eca85e6

http://drupalcode.org/project/cdn.git/commitdiff/cd2a5ff

http://drupal.org/node/1441482

http://drupal.org/node/1441480

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS