CVE-2013-4502 : The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9 f

The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9 for Drupal does not properly check file permissions, which allows remote authenticated users to read arbitrary files by attaching a file.

Published 2014-05-13 15:55:04

Updated 2014-05-14 18:34:01

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2013-4502

Nathan Haug » Filefield Sources » Version: 6.x-1.0
cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.0:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 7.x-1.5
cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.5:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 7.x-1.4
cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.4:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 6.x-1.4
cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.4:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 6.x-1.2
cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.2:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 7.x-1.2 Update Beta1
cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.2:beta1:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 6.x-1.5
cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.5:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 6.x-1.3
cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.3:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 6.x-1.1
cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.1:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 7.x-1.3
cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.3:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 7.x-1.x Update DEV
cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.x:dev:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 7.x-1.7
cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.7:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 7.x-1.6
cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.6:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 7.x-1.8
cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.8:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 6.x-1.6
cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.6:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 6.x-1.7
cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.7:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Nathan Haug » Filefield Sources » Version: 6.x-1.8
cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.8:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2013-4502

EPSS FAQ

0.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 51 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2013-4502

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

CWE ids for CVE-2013-4502

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-4502

http://seclists.org/oss-sec/2013/q4/210

oss-sec: Re: CVE request for Drupal contributed modules

CVEs referencing this url
https://drupal.org/node/2124219

filefield_sources 7.x-1.9 | Drupal.org
Patch
https://drupal.org/node/2124241

Access to this page has been denied.
Patch;Vendor Advisory
https://drupal.org/node/2124217

filefield_sources 6.x-1.9 | Drupal.org
Patch

Jump to

Vulnerability Details : CVE-2013-4502

Products affected by CVE-2013-4502

Exploit prediction scoring system (EPSS) score for CVE-2013-4502

CVSS scores for CVE-2013-4502

CWE ids for CVE-2013-4502

References for CVE-2013-4502