Information disclosure in Simplenews
Priority LOW 29CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allows remote attackers to obtain sensitive information via the confirmation page.
Why it matters now
EPSS 0.02453 84th percentileScored 2026-11-07
Fix Fixed Simplenews (Simplenews): 6.x-1.4, 6.x-2.0-alpha4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Simplenews | Simplenews | 6.x-1 to before 6.x-1.4; 6.x-2 to before 6.x-2.0-alpha4; and 7.x-1.x before 7.x-1.0-rc1 | 6.x-1.4, 6.x-2.0-alpha4 | Patch available | CNA |
- Simplenews VendorSimplenews Affected 6.x-1 to before 6.x-1.4; 6.x-2 to before 6.x-2.0-alpha4; and 7.x-1.x before 7.x-1.0-rc1 Fixed in 6.x-1.4, 6.x-2.0-alpha4 Patch available CNA
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:md-systems:simplenews:6.x-1.0:-:*:*:*:drupal:*:* | 6.x-1.0 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-1.0:beta1:*:*:*:drupal:*:* | 6.x-1.0 beta1 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-1.0:beta2:*:*:*:drupal:*:* | 6.x-1.0 beta2 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-1.0:beta3:*:*:*:drupal:*:* | 6.x-1.0 beta3 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-1.0:beta4:*:*:*:drupal:*:* | 6.x-1.0 beta4 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-1.0:beta5:*:*:*:drupal:*:* | 6.x-1.0 beta5 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc1:*:*:*:drupal:*:* | 6.x-1.0 rc1 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc2:*:*:*:drupal:*:* | 6.x-1.0 rc2 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc3:*:*:*:drupal:*:* | 6.x-1.0 rc3 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc4:*:*:*:drupal:*:* | 6.x-1.0 rc4 | Vulnerable | Md-systems |
- cpe:2.3:a:md-systems:simplenews:6.x-1.0:-:*:*:*:drupal:*:* Versions 6.x-1.0 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-1.0:beta1:*:*:*:drupal:*:* Versions 6.x-1.0 beta1 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-1.0:beta2:*:*:*:drupal:*:* Versions 6.x-1.0 beta2 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-1.0:beta3:*:*:*:drupal:*:* Versions 6.x-1.0 beta3 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-1.0:beta4:*:*:*:drupal:*:* Versions 6.x-1.0 beta4 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-1.0:beta5:*:*:*:drupal:*:* Versions 6.x-1.0 beta5 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc1:*:*:*:drupal:*:* Versions 6.x-1.0 rc1 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc2:*:*:*:drupal:*:* Versions 6.x-1.0 rc2 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc3:*:*:*:drupal:*:* Versions 6.x-1.0 rc3 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc4:*:*:*:drupal:*:* Versions 6.x-1.0 rc4 Vulnerable ·Md-systems
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc5:*:*:*:drupal:*:* | 6.x-1.0 rc5 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc6:*:*:*:drupal:*:* | 6.x-1.0 rc6 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-1.1:-:*:*:*:drupal:*:* | 6.x-1.1 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-1.2:-:*:*:*:drupal:*:* | 6.x-1.2 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-1.3:-:*:*:*:drupal:*:* | 6.x-1.3 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-2.0:alpha1:*:*:*:drupal:*:* | 6.x-2.0 alpha1 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-2.0:alpha2:*:*:*:drupal:*:* | 6.x-2.0 alpha2 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-2.0:alpha3:*:*:*:drupal:*:* | 6.x-2.0 alpha3 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:6.x-2.x:dev:*:*:*:drupal:*:* | 6.x-2.x dev | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:7.x-1.0:-:*:*:*:drupal:*:* | 7.x-1.0 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:7.x-1.0:alpha1:*:*:*:drupal:*:* | 7.x-1.0 alpha1 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:7.x-1.0:alpha2:*:*:*:drupal:*:* | 7.x-1.0 alpha2 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:7.x-1.0:beta1:*:*:*:drupal:*:* | 7.x-1.0 beta1 | Vulnerable | Md-systems |
| cpe:2.3:a:md-systems:simplenews:7.x-1.0:beta2:*:*:*:drupal:*:* | 7.x-1.0 beta2 | Vulnerable | Md-systems |
- cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc5:*:*:*:drupal:*:* Versions 6.x-1.0 rc5 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-1.0:rc6:*:*:*:drupal:*:* Versions 6.x-1.0 rc6 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-1.1:-:*:*:*:drupal:*:* Versions 6.x-1.1 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-1.2:-:*:*:*:drupal:*:* Versions 6.x-1.2 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-1.3:-:*:*:*:drupal:*:* Versions 6.x-1.3 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-2.0:alpha1:*:*:*:drupal:*:* Versions 6.x-2.0 alpha1 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-2.0:alpha2:*:*:*:drupal:*:* Versions 6.x-2.0 alpha2 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-2.0:alpha3:*:*:*:drupal:*:* Versions 6.x-2.0 alpha3 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:6.x-2.x:dev:*:*:*:drupal:*:* Versions 6.x-2.x dev Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:7.x-1.0:-:*:*:*:drupal:*:* Versions 7.x-1.0 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:7.x-1.0:alpha1:*:*:*:drupal:*:* Versions 7.x-1.0 alpha1 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:7.x-1.0:alpha2:*:*:*:drupal:*:* Versions 7.x-1.0 alpha2 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:7.x-1.0:beta1:*:*:*:drupal:*:* Versions 7.x-1.0 beta1 Vulnerable ·Md-systems
- cpe:2.3:a:md-systems:simplenews:7.x-1.0:beta2:*:*:*:drupal:*:* Versions 7.x-1.0 beta2 Vulnerable ·Md-systems
Remediation
- Fix · CNA Simplenews (Simplenews) Fixed in 6.x-1.4, 6.x-2.0-alpha4
Timeline
- 2026-10-02 Threatist record created from CVE-2012-2724
- 2026-10-03 Alias added: GHSA-59qq-h9qc-fpvf
References
Advisory 8
- http://drupal.org/node/1619848
- http://www.openwall.com/lists/oss-security/2012/06/14/3
- http://drupal.org/node/1619812
- http://drupal.org/node/1619818
- http://drupal.org/node/1619820
- http://drupalcode.org/project/simplenews.git/commitdiff/36352c1
- http://drupalcode.org/project/simplenews.git/commitdiff/6d5704c
- http://drupalcode.org/project/simplenews.git/commitdiff/faec6a6
More Simplenews vulnerabilities
- TI-2007-02510 SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote… CVSS 2.0HIGH 10.0
- TI-2007-04699 SimpNews 2.41.03 stores sensitive information under the web root with insufficient access… CVSS 2.0MEDIUM 5.0
- TI-2007-04698 SimpNews 2.41.03 allows remote attackers to obtain sensitive information via (1) an… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2012-2724 · CVE Program
- CVE-2012-2724 · NVD
- FIRST EPSS
- GHSA-59qq-h9qc-fpvf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences