CVE-2008-4790

EUVD-2008-4770
The core upload module in Drupal 5.x before 5.11 allows remote authenticated users to bypass intended access restrictions and read "files attached to content" via unknown vectors.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:S/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 47%
Affected Products (NVD)
VendorProductVersion
drupaldrupal
𝑥
≤ 5.10
drupaldrupal
5.0
drupaldrupal
5.0:beta1
drupaldrupal
5.0:beta2
drupaldrupal
5.0:rc1
drupaldrupal
5.0:rc2
drupaldrupal
5.1
drupaldrupal
5.2
drupaldrupal
5.3
drupaldrupal
5.4
drupaldrupal
5.5
drupaldrupal
5.6
drupaldrupal
5.7
drupaldrupal
5.8
drupaldrupal
5.9
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
drupal5
dapper
dne
gutsy
ignored
hardy
Fixed 5.7-1ubuntu1.2
released
intrepid
Fixed 5.10-1ubuntu1.1
released
jaunty
not-affected
karmic
not-affected
Common Weakness Enumeration
References
http://drupal.org/node/318706
http://secunia.com/advisories/32198
http://secunia.com/advisories/32200
http://www.openwall.com/lists/oss-security/2008/10/21/7
https://exchange.xforce.ibmcloud.com/vulnerabilities/45758
http://drupal.org/node/318706
http://secunia.com/advisories/32198
http://secunia.com/advisories/32200
http://www.openwall.com/lists/oss-security/2008/10/21/7
https://exchange.xforce.ibmcloud.com/vulnerabilities/45758