CVE-2008-4789: Medium severity drupal vulnerability
Published Oct 29, 2008
·Updated
The validation functionality in the core upload module in Drupal 6.x before 6.5 allows remote authenticated users to bypass intended access restrictions and "attach files to content," related to a "logic error."
Affected Software
13 affected components
Drupal Drupal<=6.4
Drupal Drupal=6.0
Drupal Drupal=6.0-beta1
Drupal Drupal=6.0-beta2
Drupal Drupal=6.0-beta3
Drupal Drupal=6.0-beta4
Drupal Drupal=6.0-rc-1
Drupal Drupal=6.0-rc-2
Drupal Drupal=6.0-rc-3
Drupal Drupal=6.0-rc-4
Drupal Drupal=6.1
Drupal Drupal=6.2
Drupal Drupal=6.3
Remediation
Patch Available
Event History
Oct 29, 2008
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-4789?
CVE-2008-4789 is categorized as a moderate severity vulnerability.
2
How do I fix CVE-2008-4789?
To fix CVE-2008-4789, you should upgrade to Drupal version 6.5 or later.
3
What type of vulnerability is CVE-2008-4789?
CVE-2008-4789 is a logic error in the core upload module of Drupal.
4
Who is affected by CVE-2008-4789?
Remote authenticated users on affected versions of Drupal are at risk from CVE-2008-4789.
5
What versions of Drupal are affected by CVE-2008-4789?
CVE-2008-4789 affects Drupal versions prior to 6.5 including 6.0-beta2 to 6.4.