Unscored CVE-2012-5537 EUVD-2012-5429GHSA-99mx-6v2c-6f3v

The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the "send scheduled newsletters" p…

Published Dec 3, 2012 · Updated Sep 17, 2024 · Assigned by redhat

Description

The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the "send scheduled newsletters" permission to inject arbitrary PHP code into the scheduling form, which is later executed by cron.

References

http://drupal.org/node/1789284
[oss-security] 20121120 Re: CVE Request for Drupal Contributed Modules mailing-list
http://drupal.org/node/1789274