CVE-2014-9156

Published Dec 1, 2014

Last updated 10 years ago

Overview

Description: The FileField module 6.x-3.x before 6.x-3.13 for Drupal does not properly check permissions to view files, which allows remote authenticated users with permission to create or edit content to read private files by attaching an uploaded file.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 2.0

Type: Primary
Base score: 4
Impact score: 2.9
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:P/I:N/A:N

Weaknesses

nvd@nist.gov: CWE-200

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:filefield_project:filefield:*:*:*:*:*:drupal:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0DEA17C3-3B90-49B4-9479-B835CAFE4DEE",
            "versionEndIncluding": "6.x-3.12"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References