Unscored CVE-2012-4487 EUVD-2012-4416GHSA-7hpx-hv32-jw4q

The Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions, which allows remote authenticated parent…

Published Nov 2, 2012 · Updated Sep 16, 2024 · Assigned by redhat

Description

The Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions, which allows remote authenticated parent users to change their role by switching to a subuser they created.

References

[oss-security] 20121004 CVE Request for Drupal Contributed Modules mailing-list
http://drupal.org/node/1700584
http://drupal.org/node/1700550
[oss-security] 20121007 Re: CVE Request for Drupal Contributed Modules mailing-list