The File module included in Drupal 7 core allowed attaching files to pieces of content. The module didn’t sufficiently check permission to view the attached file when attaching a file that was previously uploaded. This could allow attackers to gain access to private files.
Part of security release SA-CORE-2014-003
This vulnerability affects the following application versions:
- Drupal 5.0
- Drupal 5.1
- Drupal 5.2
- Drupal 5.3
- Drupal 5.4
- Drupal 5.5
- Drupal 5.6
- Drupal 5.7
- Drupal 5.10
- Drupal 5.11
- Drupal 5.12
- Drupal 5.13
- Drupal 5.14
- Drupal 5.15
- Drupal 5.16
- Drupal 5.17
- Drupal 5.18
- Drupal 5.19
- Drupal 5.20
- Drupal 5.21
- Drupal 5.22
- Drupal 5.23
- Drupal 6.0
- Drupal 6.1
- Drupal 6.2
- Drupal 6.3
- Drupal 6.4
- Drupal 6.5
- Drupal 6.6
- Drupal 6.7
- Drupal 6.8
- Drupal 6.9
- Drupal 6.10
- Drupal 6.11
- Drupal 6.12
- Drupal 6.13
- Drupal 6.14
- Drupal 6.15
- Drupal 6.16
- Drupal 6.17
- Drupal 6.18
- Drupal 6.19
- Drupal 6.20
- Drupal 6.21
- Drupal 6.22
- Drupal 6.23
- Drupal 6.24
- Drupal 6.25
- Drupal 6.26
- Drupal 6.27
- Drupal 6.28
- Drupal 6.29
- Drupal 6.30
- Drupal 6.31
- Drupal 7.0
- Drupal 7.1
- Drupal 7.2
- Drupal 7.3
- Drupal 7.4
- Drupal 7.5
- Drupal 7.6
- Drupal 7.7
- Drupal 7.8
- Drupal 7.9
- Drupal 7.10
- Drupal 7.11
- Drupal 7.12
- Drupal 7.13
- Drupal 7.14
- Drupal 7.15
- Drupal 7.16
- Drupal 7.17
- Drupal 7.18
- Drupal 7.19
- Drupal 7.20
- Drupal 7.21
- Drupal 7.22
- Drupal 7.23
- Drupal 7.24
- Drupal 7.25
- Drupal 7.26
- Drupal 7.27
- Drupal 7.28