Analyst readout for executives and security teams
Plain-English summary
CVE-2012-1651 is an authenticated cross-site scripting issue in the Drupal Submenu Tree contributed module before version 6.x-1.5. A logged-in user could inject script or HTML through unspecified paths. Business urgency depends on whether affected legacy Drupal 6 sites still run this module.
Executive priority
Treat as a cleanup priority for legacy Drupal risk. It is not known to be actively exploited from the provided sources, but exposed authenticated XSS can affect user trust and administrator sessions on still-running sites.
Technical view
The CVE record describes remote authenticated XSS in Drupal Submenu Tree before 6.x-1.5, with unspecified vectors. No CVSS, CWE, or detailed exploit conditions are provided in the source bundle. The referenced Drupal advisory appears to identify the fixed module release threshold.
Likely exposure
Exposure is likely limited to Drupal installations using the Submenu Tree module earlier than 6.x-1.5. Because Drupal 6 is legacy, organizations should especially check archived, intranet, or forgotten sites.
Exploitation context
The sources do not state active exploitation, and the CVE is not marked in CISA KEV. Exploitation requires an authenticated remote user according to the CVE description. Impact could include script execution in another user's browser if vulnerable pages render injected content.
Researcher notes
Public details are sparse: the CVE names authenticated XSS and a fixed version boundary, but not the exact vector, CVSS score, or affected configurations. Avoid assuming broader Drupal core exposure; this is identified as a Submenu Tree module issue.
Mitigation direction
- Inventory Drupal sites for the Submenu Tree contributed module.
- Confirm whether any installation runs a version before 6.x-1.5.
- Upgrade the module to 6.x-1.5 or later where applicable.
- If unsupported, follow current Drupal/vendor guidance for migration or retirement.
- Restrict authenticated access until remediation is complete.
Validation and detection
- Review Drupal module version files or administrative module listings.
- Check change records against Drupal advisory node 1461470.
- Look for legacy Drupal 6 sites in external and internal inventories.
- Review web logs for suspicious authenticated content changes.
- Confirm no affected module remains enabled after remediation.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2012-1651 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- http://drupal.org/node/1461470CVE reference · x_refsource_MISC
- 79696CVE reference · vdb-entry, x_refsource_OSVDB
- 52226CVE reference · vdb-entry, x_refsource_BID
- 48202CVE reference · third-party-advisory, x_refsource_SECUNIA
- http://drupal.org/node/1132838CVE reference · x_refsource_CONFIRM
- [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)CVE reference · mailing-list, x_refsource_MLIST
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.