CVE-2012-2724

CVE-2012-2724 describes an information disclosure vulnerability in the Simplenews module for Drupal, affecting versions 6.x-1.x, 6.x-2.x, and 7.x-1.x. When confirmation is required for new mailing list subscribers, the module inadvertently reveals their email addresses on the confirmation page. Rated with a CVSS score of 5.3 (Medium), this vulnerability has a low attack complexity and requires no user interaction, allowing remote attackers to easily obtain sensitive information. The potential impact is limited to confidentiality, as it only exposes email addresses. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has received minimal community attention, with no social media discussion or media coverage.