CVE-2011-2726
- State
- Published
- Severity
- Not scored
- Published
- Nov 15, 2019
- Updated
- Aug 6, 2024
- Reserved
- Jul 11, 2011
Description
An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied access, non-privileged users can still download the file attached to the comment if they know or guess its direct URL.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
drupal coredrupal core |
|
References
- https://security-tracker.debian.org/tracker/CVE-2011-2726
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2726
- https://access.redhat.com/security/cve/cve-2011-2726
- http://www.openwall.com/lists/oss-security/2012/03/19/10
- http://www.openwall.com/lists/oss-security/2012/03/20/14
- https://www.drupal.org/node/1231510
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.