Description

The upload module in Drupal 5.x before 5.23 and 6.x before 6.18 does not properly support case-insensitive filename handling in a database configuration, which allows remote authenticated users to bypass the intended restrictions on downloading a file by uploading a different file with a similar name.

Remediation

References

CVE-2010-3092

Related Vulnerabilities

WordPress Plugin WP-Invoice-Web Invoice and Billing Multiple Vulnerabilities (4.1.0)

PostgreSQL Other Vulnerability (CVE-2006-5541)

WordPress Plugin SS Downloads Cross-Site Request Forgery and Information Disclosure Vulnerabilities (1.4.3)

XWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2023-34466)

Zope Web Application Server Other Vulnerability (CVE-2006-4684)

Severity

Medium

Classification

CVE-2010-3092 CWE-264

Tags

Missing Update Known Vulnerabilities