CVE-2012-1645: The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expira...

Security readout for executives and security teams

This Drupal CDN module issue can let a remote attacker read PHP files that should stay private, including settings.php. That file may contain database credentials and site secrets. Exposure appears limited to specific old module versions and a particular CDN configuration. Likely exposure is Drupal sites running CDN module 6.x-2.2 or 7.x-2.2 with Origin Pull mode and Far Future expiration enabled. Sites not using this module, version line, or configuration are not shown as affected by the provided sources. Prioritize any internet-facing Drupal site matching the vulnerable configuration. The main business risk is disclosure of credentials or secrets that could enable broader site or database compromise. Mitigation focus: Inventory Drupal sites for the CDN module and affected versions.; Check whether Origin Pull and Far Future expiration are enabled.; Follow the Drupal advisory for confirmed upgrade or configuration guidance..

Prepared

Jun 28, 2026, 00:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.