CVEvulnerability
CVE-2008-4789
6.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-10-29
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The validation functionality in the core upload module in Drupal 6.x before 6.5 allows remote authenticated users to bypass intended access restrictions and "attach files to content," related to a "logic error."
Affected configurations
• drupal drupal (<= 6.4)
• drupal drupal 6.0
• drupal drupal 6.1
• drupal drupal 6.2
• drupal drupal 6.3
Related
Weakness · not in database (1)
References
- http://drupal.org/node/318706 Patch, Vendor Advisory
- http://secunia.com/advisories/32198 secunia.com
- http://www.openwall.com/lists/oss-security/2008/10/21/7 www.openwall.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45755 exchange.xforce.ibmcloud.com
- http://drupal.org/node/318706 Patch, Vendor Advisory
- http://secunia.com/advisories/32198 secunia.com
- http://www.openwall.com/lists/oss-security/2008/10/21/7 www.openwall.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45755 exchange.xforce.ibmcloud.com