CVE-2012-0825: Drupal

Medium severity, CVSS 6.8. EPSS: 2% chance of exploitation in the next 30 days.

Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.

Affected products

• Drupal Drupal: version 6.0 only; version 6.1 only; version 6.2 only; version 6.10 only; version 6.11 only; version 6.12 only; …

Published 2013-10-28. Last modified 2026-06-16.