Description

The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors.

Remediation

References

CVE-2013-0246

Related Vulnerabilities

MySQL CVE-2019-2617 Vulnerability (CVE-2019-2617)

Magento CVE-2019-8231 Vulnerability (CVE-2019-8231)

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-20416)

WordPress Plugin Easy Pixels eCommerce extension Unspecified Vulnerability (1.4)

WordPress Plugin ByREV WP-PICShield Cross-Site Request Forgery (1.9.7)

Severity

Medium

Classification

CVE-2013-0246 CWE-264

Tags

Missing Update Known Vulnerabilities