Xsendfile - Moderately critical - Access bypass - SA-CONTRIB-2023-053

2023-11-2900:00:00

Drupal Security Team

www.drupal.org

xsendfile module

private files transfer

drupal

imagestyledownloadcontroller

vulnerability

sa-core-2023-005

AI Score

Confidence

Low

JSON

The Xsendfile module enables fast transfer for private files in Drupal. In order to control private file downloads, the module overrides ImageStyleDownloadController, for which a vulnerability was disclosed in SA-CORE-2023-005. The Xsendfile module was still based on an insecure version of ImageStyleDownloadController.

Affected configurations

Vulners

Node

drupalxsendfileRange<8.x-1.2.

VendorProductVersionCPE
drupalxsendfile*cpe:2.3:a:drupal:xsendfile:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
drupal	xsendfile	*	cpe:2.3:a:drupal:xsendfile::::::::

References

www.drupal.org/project/xsendfile/releases/8.x-1.2

www.drupal.org/sa-core-2023-005

www.drupal.org/user/1790054

www.drupal.org/user/33235

www.drupal.org/user/3611858

www.drupal.org/user/36762

www.drupal.org/user/97688

AI Score

Confidence

Low

JSON