Access bypass in private file fields on comments.
Drupal 7 contains two new features: the ability to attach File upload fields to any entity type in the system and the ability to point individual File upload fields to the private file directory.
If a Drupal site was using these features on comments, and the parent node was denied access (either by a node access module or by being unpublished), the file attached to the comment could still be downloaded by non-privileged users if they know or guess its direct URL.
Part of security release SA-CORE-2011-003
This vulnerability affects the following application versions:
- Drupal 7.0
- Drupal 7.1
- Drupal 7.2
- Drupal 7.3
- Drupal 7.4