CVEvulnerability
CVE-2013-0246
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-07-16
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors.
Affected configurations
• drupal drupal 7.0
• drupal drupal 7.1
• drupal drupal 7.2
• drupal drupal 7.3
• drupal drupal 7.4
• drupal drupal 7.5
• drupal drupal 7.6
• drupal drupal 7.7
• drupal drupal 7.8
• drupal drupal 7.9
• drupal drupal 7.10
• drupal drupal 7.11
• drupal drupal 7.12
• drupal drupal 7.13
• drupal drupal 7.14
• drupal drupal 7.15
• drupal drupal 7.16
• drupal drupal 7.17
• drupal drupal 7.18
• drupal drupal 7.x-dev
Related
Weakness · not in database (1)
References
- http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2013/Jan/120 seclists.org
- http://seclists.org/oss-sec/2013/q1/211 seclists.org
- http://secunia.com/advisories/51717 Vendor Advisory
- https://drupal.org/SA-CORE-2013-001 Patch, Vendor Advisory
- http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2013/Jan/120 seclists.org
- http://seclists.org/oss-sec/2013/q1/211 seclists.org
- http://secunia.com/advisories/51717 Vendor Advisory
- https://drupal.org/SA-CORE-2013-001 Patch, Vendor Advisory