CVE-2011-2726
High
Description
An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied access, non-privileged users can still download the file attached to the comment if they know or guess its direct URL.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Drupal
PublishedNov 15, 2019
First seenNov 15, 2019
How to fix
Update
- drupal drupal7.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal drupal | 7.0 ≤ v < 7.5 | 7.5 |
| debian debian_linux | 8.0, 9.0 | — |
| redhat enterprise_linux | 5.0, 6.0 | — |
| fedoraproject fedora | 14, 15, 16 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.