Design/Logic Flaw

2010-09-2120:00:00

PRIOn knowledge base

www.prio-n.com

6.7 Medium

AI Score

Confidence

Low

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

50.3%

JSON

The upload module in Drupal 5.x before 5.23 and 6.x before 6.18 does not properly support case-insensitive filename handling in a database configuration, which allows remote authenticated users to bypass the intended restrictions on downloading a file by uploading a different file with a similar name.

CPENameOperatorVersion
drupaleq5.10
drupaleq5.4
drupaleq5.17
drupaleq5.13
drupaleq5.12
drupaleq5.2
drupaleq5.7
drupaleq5.0 rc2
drupaleq5.16
drupaleq5.0