Lucene search

Debian Security Bug TrackerDEBIANCVE:CVE-2014-5020

HistoryJul 22, 2014 - 2:55 p.m.

CVE-2014-5020

2014-07-2214:55:00

Debian Security Bug Tracker

security-tracker.debian.org

4.9 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

JSON

The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field.

OSVersionArchitecturePackageVersionFilename
Debian9alldrupal7< 7.52-2+deb9u11drupal7_7.52-2+deb9u11_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	all	drupal7	< 7.52-2+deb9u11	drupal7_7.52-2+deb9u11_all.deb

4.9 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

JSON

Related for DEBIANCVE:CVE-2014-5020