Search
Find a vulnerability
Search criteria
4 vulnerabilities found for filefield by quicksketch
CVE-2010-1958 (GCVE-0-2010-1958)
Vulnerability from nvd – Published: 2010-06-21 19:00 – Updated: 2024-08-07 02:17
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and 'Path to File' or 'URL to File' display enabled, to inject arbitrary web script or HTML via the file name (filepath parameter).
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://osvdb.org/65611 | vdb-entryx_refsource_OSVDB |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://drupal.org/node/829808 | x_refsource_CONFIRM |
| http://www.madirish.net/?article=461 | x_refsource_MISC |
| http://secunia.com/advisories/40186 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/40923 | vdb-entryx_refsource_BID |
Date Public
2010-06-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:17:13.738Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "65611",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/65611"
},
{
"name": "filefieldmodule-filepath-xss(59500)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59500"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/829808"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.madirish.net/?article=461"
},
{
"name": "40186",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40186"
},
{
"name": "40923",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/40923"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-06-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and \u0027Path to File\u0027 or \u0027URL to File\u0027 display enabled, to inject arbitrary web script or HTML via the file name (filepath parameter)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "65611",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/65611"
},
{
"name": "filefieldmodule-filepath-xss(59500)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59500"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/829808"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.madirish.net/?article=461"
},
{
"name": "40186",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40186"
},
{
"name": "40923",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/40923"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-1958",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and \u0027Path to File\u0027 or \u0027URL to File\u0027 display enabled, to inject arbitrary web script or HTML via the file name (filepath parameter)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "65611",
"refsource": "OSVDB",
"url": "http://osvdb.org/65611"
},
{
"name": "filefieldmodule-filepath-xss(59500)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59500"
},
{
"name": "http://drupal.org/node/829808",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/829808"
},
{
"name": "http://www.madirish.net/?article=461",
"refsource": "MISC",
"url": "http://www.madirish.net/?article=461"
},
{
"name": "40186",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40186"
},
{
"name": "40923",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/40923"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-1958",
"datePublished": "2010-06-21T19:00:00.000Z",
"dateReserved": "2010-05-19T00:00:00.000Z",
"dateUpdated": "2024-08-07T02:17:13.738Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-3781 (GCVE-0-2009-3781)
Vulnerability from nvd – Published: 2009-10-26 17:00 – Updated: 2024-08-07 06:38
VLAI
EPSS
VEX
Summary
The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://drupal.org/node/516104 | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/36792 | vdb-entryx_refsource_BID |
| http://drupal.org/node/611128 | x_refsource_CONFIRM |
| http://drupal.org/node/609874 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://drupal.org/files/issues/filefield-node-acc… | x_refsource_CONFIRM |
| http://secunia.com/advisories/37130 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2009-10-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:38:30.316Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/516104"
},
{
"name": "36792",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/36792"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/611128"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/609874"
},
{
"name": "filefield-nodeaccess-security-bypass(53897)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53897"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/files/issues/filefield-node-access-fix-516104-3.patch"
},
{
"name": "37130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/37130"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/516104"
},
{
"name": "36792",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/36792"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/611128"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/609874"
},
{
"name": "filefield-nodeaccess-security-bypass(53897)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53897"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/files/issues/filefield-node-access-fix-516104-3.patch"
},
{
"name": "37130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/37130"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-3781",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://drupal.org/node/516104",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/516104"
},
{
"name": "36792",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/36792"
},
{
"name": "http://drupal.org/node/611128",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/611128"
},
{
"name": "http://drupal.org/node/609874",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/609874"
},
{
"name": "filefield-nodeaccess-security-bypass(53897)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53897"
},
{
"name": "http://drupal.org/files/issues/filefield-node-access-fix-516104-3.patch",
"refsource": "CONFIRM",
"url": "http://drupal.org/files/issues/filefield-node-access-fix-516104-3.patch"
},
{
"name": "37130",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/37130"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-3781",
"datePublished": "2009-10-26T17:00:00.000Z",
"dateReserved": "2009-10-26T00:00:00.000Z",
"dateUpdated": "2024-08-07T06:38:30.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-1958 (GCVE-0-2010-1958)
Vulnerability from cvelistv5 – Published: 2010-06-21 19:00 – Updated: 2024-08-07 02:17
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and 'Path to File' or 'URL to File' display enabled, to inject arbitrary web script or HTML via the file name (filepath parameter).
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://osvdb.org/65611 | vdb-entryx_refsource_OSVDB |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://drupal.org/node/829808 | x_refsource_CONFIRM |
| http://www.madirish.net/?article=461 | x_refsource_MISC |
| http://secunia.com/advisories/40186 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/40923 | vdb-entryx_refsource_BID |
Date Public
2010-06-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:17:13.738Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "65611",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/65611"
},
{
"name": "filefieldmodule-filepath-xss(59500)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59500"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/829808"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.madirish.net/?article=461"
},
{
"name": "40186",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40186"
},
{
"name": "40923",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/40923"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-06-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and \u0027Path to File\u0027 or \u0027URL to File\u0027 display enabled, to inject arbitrary web script or HTML via the file name (filepath parameter)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "65611",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/65611"
},
{
"name": "filefieldmodule-filepath-xss(59500)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59500"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/829808"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.madirish.net/?article=461"
},
{
"name": "40186",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40186"
},
{
"name": "40923",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/40923"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-1958",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and \u0027Path to File\u0027 or \u0027URL to File\u0027 display enabled, to inject arbitrary web script or HTML via the file name (filepath parameter)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "65611",
"refsource": "OSVDB",
"url": "http://osvdb.org/65611"
},
{
"name": "filefieldmodule-filepath-xss(59500)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59500"
},
{
"name": "http://drupal.org/node/829808",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/829808"
},
{
"name": "http://www.madirish.net/?article=461",
"refsource": "MISC",
"url": "http://www.madirish.net/?article=461"
},
{
"name": "40186",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40186"
},
{
"name": "40923",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/40923"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-1958",
"datePublished": "2010-06-21T19:00:00.000Z",
"dateReserved": "2010-05-19T00:00:00.000Z",
"dateUpdated": "2024-08-07T02:17:13.738Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-3781 (GCVE-0-2009-3781)
Vulnerability from cvelistv5 – Published: 2009-10-26 17:00 – Updated: 2024-08-07 06:38
VLAI
EPSS
VEX
Summary
The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://drupal.org/node/516104 | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/36792 | vdb-entryx_refsource_BID |
| http://drupal.org/node/611128 | x_refsource_CONFIRM |
| http://drupal.org/node/609874 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://drupal.org/files/issues/filefield-node-acc… | x_refsource_CONFIRM |
| http://secunia.com/advisories/37130 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2009-10-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:38:30.316Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/516104"
},
{
"name": "36792",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/36792"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/611128"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/609874"
},
{
"name": "filefield-nodeaccess-security-bypass(53897)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53897"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/files/issues/filefield-node-access-fix-516104-3.patch"
},
{
"name": "37130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/37130"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/516104"
},
{
"name": "36792",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/36792"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/611128"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/609874"
},
{
"name": "filefield-nodeaccess-security-bypass(53897)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53897"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/files/issues/filefield-node-access-fix-516104-3.patch"
},
{
"name": "37130",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/37130"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-3781",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://drupal.org/node/516104",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/516104"
},
{
"name": "36792",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/36792"
},
{
"name": "http://drupal.org/node/611128",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/611128"
},
{
"name": "http://drupal.org/node/609874",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/609874"
},
{
"name": "filefield-nodeaccess-security-bypass(53897)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53897"
},
{
"name": "http://drupal.org/files/issues/filefield-node-access-fix-516104-3.patch",
"refsource": "CONFIRM",
"url": "http://drupal.org/files/issues/filefield-node-access-fix-516104-3.patch"
},
{
"name": "37130",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/37130"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-3781",
"datePublished": "2009-10-26T17:00:00.000Z",
"dateReserved": "2009-10-26T00:00:00.000Z",
"dateUpdated": "2024-08-07T06:38:30.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}