CVE-2014-5020: vulnerability facts

CVE-2014-5020

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field.

EPSS 1.3%

Published: 2014-07-22T14:00:00.000Z
Updated: 2024-09-16T18:08:33.200Z

Stack: system

Affected products and versions

n/a
Versions
- n/a: Affected
No fix published
drupal7 Ubuntu:Pro:14.04:LTS
Versions
- 7.23-1
- 7.24-1
- 7.24-2
- 7.26-1
- 7.26-1ubuntu0.1
- 7.26-1ubuntu0.1+esm1
- 7.26-1ubuntu0.1+esm2
- 7.26-1ubuntu0.1+esm3
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published

Original sources

http://www.debian.org/security/2014/dsa-2983
https://www.drupal.org/SA-CORE-2014-003
https://nvd.nist.gov/vuln/detail/CVE-2014-5020

Check your server →

CVE-2014-5020

Affected products and versions

n/a

drupal7 Ubuntu:Pro:14.04:LTS

Original sources