CVEvulnerability

CVE-2015-4393

6.0 MEDIUM Published 2015-06-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2015-06-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
Weaknesses
CWE-20

Description

The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with the "Save file information" permission to execute arbitrary code via a crafted filename.

Affected configurations

• services project services 7.x-3.0 • services project services 7.x-3.1 • services project services 7.x-3.2 • services project services 7.x-3.3 • services project services 7.x-3.4 • services project services 7.x-3.5 • services project services 7.x-3.6 • services project services 7.x-3.7 • services project services 7.x-3.9 • services project services 7.x-3.10 • services project services 7.x-3.11

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References