SB2013102902 - Access bypass in Drupal Drupal
Published: October 29, 2013 Updated: September 15, 2016
Security Bulletin ID
SB2013102902
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Access bypass (CVE-ID: CVE-2012-0827)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to become allowed to download information.
The weakness exists due to access control error. Combined using of private files and field access modules helps unallowed users to get permission from File module to download files.
Successful exploitation of the vulnerability allows user to download files on the certain fields.
Remediation
Install update from vendor's website.