CVE-2012-5588

The Email Field module 6.x-1.x before 6.x-1.3 for Drupal, when using a field permission module and the field contact field formatter is set to the full or teaser display mode, does not properly check permissions, which allows remote attackers to email the stored address via unspecified vectors.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
2.6 UNKNOWN
NETWORK
HIGH
AV:N/AC:H/Au:N/C:N/I:P/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
VendorProductVersion
epiqoemail
6.x-1.0:x
epiqoemail
6.x-1.0:x
epiqoemail
6.x-1.1:x
epiqoemail
6.x-1.2:x
epiqoemail
6.x-1.x:x
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://drupal.org/node/1852612
http://drupal.org/node/1853214
http://www.openwall.com/lists/oss-security/2012/11/29/2
http://drupal.org/node/1852612
http://drupal.org/node/1853214
http://www.openwall.com/lists/oss-security/2012/11/29/2