CVE-2014-9156: Infoleak
The FileField module 6.x-3.x before 6.x-3.13 for Drupal does not properly check permissions to view files, which allows remote authenticated users with permission to create or edit content to read private files by attaching an uploaded file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9156?
CVE-2014-9156 is considered a moderate severity vulnerability due to the potential for unauthorized access to private files.
How do I fix CVE-2014-9156?
To fix CVE-2014-9156, update the FileField module to version 6.x-3.13 or later.
Who is affected by CVE-2014-9156?
CVE-2014-9156 affects remote authenticated users with the permission to create or edit content in Drupal versions prior to 6.x-3.13.
What type of vulnerability is CVE-2014-9156?
CVE-2014-9156 is a file access vulnerability that allows users to read private files they should not have access to.
What software does CVE-2014-9156 affect?
CVE-2014-9156 affects the FileField module versions 6.x-3.x before 6.x-3.13 for Drupal.