Servers and applications
CVE-2012-2922 The request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q[] parameter to index.php, which reveals the installation path in an error message.
Severity Medium 5.0
Published 21 May 2012
Last changed 16 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 3% in the next 30 daysHigher than 87% of CVEs. EPSS by FIRST , 12 Nov 2026
Attack Over the network · No login needed
Attacker can Read some data
CVSS vector AV:N/AC:L/Au:N/C:P/I:N/A:N
Sources NVD Affected software Software Affected versions DrupalServers and applications · cpe:a:drupal:drupal Version 7.12 Version 7.11 Version 7.10 Version 7.9 All 79 release lines Every version up to 7.14 Version 5.0-dev Version 5.0-beta1 Version 5.0-beta2 Version 5.0-rc1 Version 5.0-rc2 Version 5.0 Version 5.1 Version 5.2 Version 5.3 Version 5.4 Version 5.5 Version 5.6 Version 5.7 Version 5.8 Version 5.9 Version 5.10 Version 5.11 Version 5.12 Version 5.13 Version 5.14 Version 5.15 Version 5.16 Version 5.17 Version 5.18 Version 5.19 Version 5.20 Version 5.21 Version 5.22 Version 5.23 Version 6.0-dev Version 6.0-beta1 Version 6.0-beta2 Version 6.0-beta3 Version 6.0-beta4 Version 6.0-rc1 Version 6.0-rc2 Version 6.0-rc3 Version 6.0-rc4 Version 6.0 Version 6.1 Version 6.2 Version 6.3 Version 6.4 Version 6.5 Version 6.6 Version 6.7 Version 6.8 Version 6.9 Version 6.10 Version 6.11 Version 6.12 Version 6.13 Version 6.14 Version 6.15 Version 6.16 Version 6.17 Version 6.18 Version 7.0-dev Version 7.0-alpha1 Version 7.0-alpha2 Version 7.0-alpha3 Version 7.0-alpha4 Version 7.0-alpha5 Version 7.0-alpha6 Version 7.0-alpha7 Version 7.0 Version 7.1 Version 7.2 Version 7.3 Version 7.4 Version 7.5 Version 7.6 Version 7.7 Version 7.8 Version 7.9 Version 7.10 Version 7.11 Version 7.12
References NVD https://nvd.nist.gov/vuln/detail/CVE-2012-2922 CVE.org https://www.cve.org/CVERecord?id=CVE-2012-2922