PT-2014-8856 · Drupal · Filefield

Published 2014-12-01 · Updated 2014-12-01 · CVE-2014-9156

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FileField module versions 6.x-3.x before 6.x-3.13

Description The issue allows remote authenticated users with permission to create or edit content to read private files by attaching an uploaded file, due to improper permission checks to view files.

Recommendations For FileField module versions 6.x-3.x before 6.x-3.13, update to version 6.x-3.13 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-9156

Affected Products

Filefield

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-9156 · Security Note
• http://cgit.drupalcode.org/filefield/commit/?id=3a97fe1 · Vendor Advisory
• https://drupal.org/node/2304517 · Vendor Advisory
• https://drupal.org/node/2304561 · Vendor Advisory