CVE-2014-9156

The FileField module 6.x-3.x before 6.x-3.13 for Drupal does not properly check permissions to view files, which allows remote authenticated users with permission to create or edit content to read private files by attaching an uploaded file.

Score

CVSS 2.0 4.0 Medium

Status

Modified - cve@mitre.org

Published

2014-12-01

Last modified

2024-09-17

Weaknesses

CWE-200

Affected products

• Filefield (Filefield Project)

References

• http://cgit.drupalcode.org/filefield/commit/?id=3a97fe1
• https://www.drupal.org/node/2304517
• https://www.drupal.org/node/2304561