Access bypass in Drupal - CVE-2013-0246
Published: September 15, 2016
Vulnerability identifier: #VU460
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2013-0246
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Drupal
Affected software:
Drupal
Drupal
Detailed vulnerability description
The vulnerability allows a remote user to get access to private images on the target system.
The weakness exists due to improper image derivatives protection that may result in attacker's access to the images he wasn't allowed to see before.
Successful exploitation of the vulnerability allows a malicious user to obtain unallowed images.
The weakness exists due to improper image derivatives protection that may result in attacker's access to the images he wasn't allowed to see before.
Successful exploitation of the vulnerability allows a malicious user to obtain unallowed images.