CVE-2012-2073

MEDIUM 6.0CVE-2012-2073 · Published 14/08/2012 · updated 16/06/2026

In short

CVE-2012-2073 is a MEDIUM (CVSS 6.0) vulnerability affecting bundle copy (kristof de jaeger).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
bundle copy kristof_de_jaeger	`= 7.x-1.0= 7.x-1.x`	No fix yet

Description

The Bundle copy module 7.x-1.x before 7.x-1.1 for Drupal does not check for the "use PHP for settings" permission while importing settings, which allows remote authenticated users with certain permissions to execute arbitrary PHP code via unspecified vectors.

References

drupal.org/node/1506166 · Patch
drupal.org/node/1506420 · Patch
drupalcode.org/project/bundle_copy.git/commit/299bdca
osvdb.org/80676
secunia.com/advisories/48626 · Vendor Advisory
openwall.com/lists/oss-security/2012/04/07/1
securityfocus.com/bid/52811
exchange.xforce.ibmcloud.com/vulnerabilities/74439

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free