* Advisory ID: DRUPAL-SA-CONTRIB-2009-082 * Project: FileField (third-party module) * Version: 6.x * Date: 2009-October-20 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Access bypass
.... Description
The FileField module allows users to upload files through an AJAX-upload widget that can be added to content types through CCK. In the 3.1 version of FileField, the module would not restrict access to files based on node-access permissions when using Drupal core's private file system. .... Versions affected
* FileField module 6.x-3.1 only
Drupal core is not affected. If you do not use the contributed FileField module, there is nothing you need to do. .... Solution
Install the latest version. * If you use the FileField module for Drupal 6.x upgrade to FileField module 6.x-3.2 [1]
See also the FileField module project page [2]. .... Reported by
isaac77 [3]. .... Fixed by
isaac77 [4] and quicksketch [5] the module maintainer. .... Contact
The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.
[1] http://drupal.org/node/609874 [2] http://drupal.org/project/filefield [3] http://drupal.org/user/49318 [4] http://drupal.org/user/49318 [5] http://drupal.org/user/35821