Unscored severity · published Oct 26, 2009
CVE-2009-3781
The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote…
–
CVSS
2.2%
EPSS
No
On KEV
Description
The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Filefield · Quicksketch
6.x-3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3781
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3781
Patch
http://drupal.org/files/issues/filefield-node-access-fix-516104-3.patch
Issue Tracking
http://drupal.org/node/516104
Release Notes
http://drupal.org/node/609874
Patch
http://drupal.org/node/611128
Broken Link
http://secunia.com/advisories/37130
Broken Link
http://www.securityfocus.com/bid/36792
More from Filefield
–
CVE-2010-1958
Cross-site scripting (XSS) vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit…