CVE-2011-2726
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied access, non-privileged users can still download the file attached to the comment if they know or guess its direct URL.
Se encontró un problema de omisión de acceso en Drupal versiones 7.x anteriores a la versión 7.5. Si un sitio de Drupal posee la capacidad de adjuntar campos de carga de Archivos hacia cualquier tipo de entidad en el sistema o tiene la capacidad de apuntar campos de carga de Archivos individuales hacia el directorio de archivos privados en comentarios, y el nodo principal tiene acceso denegado, los usuarios no privilegiados pueden aún descargar el archivo adjunto en el comentario si conocen o adivinan su URL directa.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2011-07-11 CVE Reserved
- 2019-11-15 CVE Published
- 2024-08-06 CVE Updated
- 2024-11-08 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-863: Incorrect Authorization
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2012/03/19/10 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2012/03/20/14 | Mailing List |
|
| https://access.redhat.com/security/cve/cve-2011-2726 | Broken Link | |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2726 | Issue Tracking | |
| https://security-tracker.debian.org/tracker/CVE-2011-2726 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.drupal.org/node/1231510 | 2019-12-03 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Drupal Search vendor "Drupal" | Drupal Search vendor "Drupal" for product "Drupal" | >= 7.0 < 7.5 Search vendor "Drupal" for product "Drupal" and version " >= 7.0 < 7.5" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 5.0 Search vendor "Redhat" for product "Enterprise Linux" and version "5.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 6.0 Search vendor "Redhat" for product "Enterprise Linux" and version "6.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 14 Search vendor "Fedoraproject" for product "Fedora" and version "14" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 15 Search vendor "Fedoraproject" for product "Fedora" and version "15" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 16 Search vendor "Fedoraproject" for product "Fedora" and version "16" | - |
Affected
| ||||||