Drupal FileField Module Information Disclosure Vulnerability
BID:36792
Info
Drupal FileField Module Information Disclosure Vulnerability
| Bugtraq ID: | 36792 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 21 2009 12:00AM |
| Updated: | Oct 22 2009 04:48PM |
| Credit: | isaac77 |
| Vulnerable: |
Drupal FileField 6.x-3.1 |
| Not Vulnerable: |
Drupal FileField 6.x-3.2 |
Discussion
Drupal FileField Module Information Disclosure Vulnerability
The FileField module for Drupal is prone to an information-disclosure vulnerability because it fails to restrict access to certain files.
Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.
The issue affects FileField 6.x-3.1.
The FileField module for Drupal is prone to an information-disclosure vulnerability because it fails to restrict access to certain files.
Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.
The issue affects FileField 6.x-3.1.
Exploit / POC
Drupal FileField Module Information Disclosure Vulnerability
Attackers can exploit this issue via a browser.
Attackers can exploit this issue via a browser.
Solution / Fix
Drupal FileField Module Information Disclosure Vulnerability
Solution:
The vendor has released fixes and an advisory. Please see the references for details.
Drupal FileField 6.x-3.1
Solution:
The vendor has released fixes and an advisory. Please see the references for details.
Drupal FileField 6.x-3.1
-
Drupal filefield 6.x-3.2
http://drupal.org/node/609874
References
Drupal FileField Module Information Disclosure Vulnerability
References:
References: