Search criteria

2 vulnerabilities found for File Download by Drupal

CVE-2025-7717 (GCVE-0-2025-7717)

Vulnerability from nvd – Published: 2025-07-21 16:37 – Updated: 2025-07-22 14:00
VLAI?
Title
File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089
Summary
Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.This issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 before 2.0.1.
Severity ?
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
Drupal File Download Affected: 0.0.0 , < 1.9.0 (semver)
Affected: 2.0.0 , < 2.0.1 (semver)
Create a notification for this product.
Credits
Willem Drupal enthousiast (willempje2) Shelane French (shelane) Willem Drupal enthousiast (willempje2) Greg Knaddison (greggles) Juraj Nemec (poker10) Jess (xjm)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-7717",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-22T13:59:18.221090Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-22T14:00:15.979Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/file_download",
          "defaultStatus": "unaffected",
          "product": "File Download",
          "repo": "https://git.drupalcode.org/project/file_download",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.9.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Willem Drupal enthousiast (willempje2)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Shelane French (shelane)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Willem Drupal enthousiast (willempje2)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2025-07-16T16:46:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.\u003cp\u003eThis issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 before 2.0.1.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.This issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 before 2.0.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-21T16:37:14.684Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2025-089"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2025-7717",
    "datePublished": "2025-07-21T16:37:14.684Z",
    "dateReserved": "2025-07-16T14:53:54.139Z",
    "dateUpdated": "2025-07-22T14:00:15.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-7717 (GCVE-0-2025-7717)

Vulnerability from cvelistv5 – Published: 2025-07-21 16:37 – Updated: 2025-07-22 14:00
VLAI?
Title
File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089
Summary
Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.This issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 before 2.0.1.
Severity ?
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
Drupal File Download Affected: 0.0.0 , < 1.9.0 (semver)
Affected: 2.0.0 , < 2.0.1 (semver)
Create a notification for this product.
Credits
Willem Drupal enthousiast (willempje2) Shelane French (shelane) Willem Drupal enthousiast (willempje2) Greg Knaddison (greggles) Juraj Nemec (poker10) Jess (xjm)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-7717",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-22T13:59:18.221090Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-22T14:00:15.979Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/file_download",
          "defaultStatus": "unaffected",
          "product": "File Download",
          "repo": "https://git.drupalcode.org/project/file_download",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.9.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Willem Drupal enthousiast (willempje2)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Shelane French (shelane)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Willem Drupal enthousiast (willempje2)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2025-07-16T16:46:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.\u003cp\u003eThis issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 before 2.0.1.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.This issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 before 2.0.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-21T16:37:14.684Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2025-089"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2025-7717",
    "datePublished": "2025-07-21T16:37:14.684Z",
    "dateReserved": "2025-07-16T14:53:54.139Z",
    "dateUpdated": "2025-07-22T14:00:15.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}