VulnerabilityModified

CVE-2009-3781

The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors.

HIGH 7.5EPSS 2.16%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.16%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 2.16% probability · 81th percentile
CISA KEV: Not listed
Weakness: CWE-862
Affected: quicksketch/filefield
Source: cve@mitre.org

References

http://drupal.org/files/issues/filefield-node-access-fix-516104-3.patchPatch
http://drupal.org/node/516104Issue Tracking, Patch, Third Party Advisory
http://drupal.org/node/609874Release Notes
http://drupal.org/node/611128Patch, Third Party Advisory
http://secunia.com/advisories/37130Broken Link, Third Party Advisory
http://www.securityfocus.com/bid/36792Broken Link, Patch, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/53897Third Party Advisory, VDB Entry
http://drupal.org/files/issues/filefield-node-access-fix-516104-3.patchPatch
http://drupal.org/node/516104Issue Tracking, Patch, Third Party Advisory
http://drupal.org/node/609874Release Notes
http://drupal.org/node/611128Patch, Third Party Advisory
http://secunia.com/advisories/37130Broken Link, Third Party Advisory
http://www.securityfocus.com/bid/36792Broken Link, Patch, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/53897Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.