CVE-2012-4554

The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file.

Score

CVSS 2.0 5.0 Medium

Status

Modified - secalert@redhat.com

Published

2012-11-11

Last modified

2024-09-17

Weaknesses

CWE-264

Affected products

• Drupal (Drupal)

References

• http://drupal.org/node/1815912
• http://drupalcode.org/project/drupal.git/commit/b912710
• http://www.openwall.com/lists/oss-security/2012/10/29/4
• http://www.openwall.com/lists/oss-security/2012/10/30/5