CVEvulnerability

CVE-2009-3781

7.5 HIGH Published 2009-10-26 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2009-10-26
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses: CWE-862

Description

The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors.

Affected configurations

• quicksketch filefield 6.x-3.1

Weakness · CWE (1)

CWE-862 Missing Authorization weakness

Referenced by CWE · observed example (2)

CWE-285 Improper Authorization weakness
CWE-862 Missing Authorization weakness

References

http://drupal.org/files/issues/filefield-node-access-fix-516104-3.patch Patch
http://drupal.org/node/516104 Issue Tracking, Patch, Third Party Advisory
http://drupal.org/node/609874 Release Notes
http://drupal.org/node/611128 Patch, Third Party Advisory
http://secunia.com/advisories/37130 Broken Link, Third Party Advisory
http://www.securityfocus.com/bid/36792 Broken Link, Patch, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/53897 Third Party Advisory, VDB Entry
http://drupal.org/files/issues/filefield-node-access-fix-516104-3.patch Patch
http://drupal.org/node/516104 Issue Tracking, Patch, Third Party Advisory
http://drupal.org/node/609874 Release Notes
http://drupal.org/node/611128 Patch, Third Party Advisory
http://secunia.com/advisories/37130 Broken Link, Third Party Advisory
http://www.securityfocus.com/bid/36792 Broken Link, Patch, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/53897 Third Party Advisory, VDB Entry