Описание
The FileField module 6.x-3.x before 6.x-3.13 for Drupal does not properly check permissions to view files, which allows remote authenticated users with permission to create or edit content to read private files by attaching an uploaded file.
Ссылки
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 6.x-3.12 (включая)
cpe:2.3:a:filefield_project:filefield:*:*:*:*:*:drupal:*:*
EPSS
Процентиль: 36%
0.00151
Низкий
4 Medium
CVSS2
Дефекты
CWE-200
Связанные уязвимости
github
больше 3 лет назад
The FileField module 6.x-3.x before 6.x-3.13 for Drupal does not properly check permissions to view files, which allows remote authenticated users with permission to create or edit content to read private files by attaching an uploaded file.
EPSS
Процентиль: 36%
0.00151
Низкий
4 Medium
CVSS2
Дефекты
CWE-200