High severity · published Nov 13, 2019
CVE-2011-4972
hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct…
7.5
CVSS
1.7%
EPSS
No
On KEV
Description
hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CK
Ckeditor · Ckeditor
7.x-1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4972
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4972
Mailing List
http://www.openwall.com/lists/oss-security/2013/06/04/5
Mailing List
http://www.openwall.com/lists/oss-security/2013/06/04/7
Patch
https://drupal.org/node/1337006
More from Ckeditor
9.8
CVE-2023-31541
A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be…
7.5
CVE-2022-24729
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor
6.5
CVE-2021-26272
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space…
6.5
CVE-2021-26271
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the…
6.1
CVE-2024-43407
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor