CVE-2009-3781: High severity quicksketch filefield vulnerability
The filefieldfiledownload function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
Who is exposed to this issue?
Drupal sites using the Quicksketch FileField module version 6.x-3.1 with Drupal core private files are exposed. The flaw affects access checks for files served through the module's filefield_file_download function.
Does an attacker need an account or special privileges?
No. The vulnerability is rated as remotely exploitable with low attack complexity and no authentication required.
What could an attacker do?
A remote attacker may access files that should be restricted by Drupal node-access permissions. The listed impact includes confidentiality, integrity, and availability.
What should teams do to remediate the issue?
Apply the available patch. The provided advisory references include Drupal pages for the issue and remediation information.