View online: https://www.drupal.org/sa-contrib-2018-007

Project: FileField Sources [1] Date: 2018-February-07 Security risk: *Moderately critical* 12∕25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Information Disclosure

Description:  This module enables you to upload files to fields via several sources.

The module doesn't sufficiently handle access control under the scenario of the autocomplete path of reference sources.

Solution:  Install the latest version:

* If you use the filefield_sources module provided reference source for Drupal 7.x, upgrade to 7.x-1.11. [3]

Reported By:  * Tatar Balazs Janos [4] Provisional Security Team member

Fixed By:  * Tatar Balazs Janos [5] Provisional Security Team member * Nate Lampton [6] the module maintainer

Coordinated By:  * Michael Hess [7] of the Drupal Security Team

[1] https://www.drupal.org/project/filefield_sources [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/filefield_sources/releases/7.x-1.11 [4] https://www.drupal.org/u/tatarbj [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/user/35821 [7] https://www.drupal.org/u/mlhess