Description

The validation functionality in the core upload module in Drupal 6.x before 6.5 allows remote authenticated users to bypass intended access restrictions and "attach files to content," related to a "logic error."

Remediation

References

CVE-2008-4789

Related Vulnerabilities

Ruby on Rails Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-6497)

WordPress Plugin Async JavaScript Security Bypass (2.19.07.14)

Drupal Other Vulnerability (CVE-2005-1871)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-0192)

MySQL CVE-2018-2755 Vulnerability (CVE-2018-2755)

Severity

Medium

Classification

CVE-2008-4789 CWE-264

Tags

Missing Update Known Vulnerabilities