News
Vigil@nce - Drupal FileField: information disclosure
February 2014 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can read private files of Drupal FileField, in order
to obtain sensitive information.
Impacted products: Drupal Modules
Severity: 2/4
Creation date: 13/02/2014
DESCRIPTION OF THE VULNERABILITY
The FileField module can be installed on Drupal.
However, an attacker can bypass access restrictions to files
attached to revisions.
An attacker can therefore read private files of Drupal FileField,
in order to obtain sensitive information.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Drupal-FileField-information-disclosure-14242
