Search criteria
6 vulnerabilities found for filefield_sources by nathan_haug
FKIE_CVE-2013-4502
Vulnerability from fkie_nvd - Published: 2014-05-13 15:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9 for Drupal does not properly check file permissions, which allows remote authenticated users to read arbitrary files by attaching a file.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| nathan_haug | filefield_sources | 7.x-1.2 | |
| nathan_haug | filefield_sources | 7.x-1.3 | |
| nathan_haug | filefield_sources | 7.x-1.4 | |
| nathan_haug | filefield_sources | 7.x-1.5 | |
| nathan_haug | filefield_sources | 7.x-1.6 | |
| nathan_haug | filefield_sources | 7.x-1.7 | |
| nathan_haug | filefield_sources | 7.x-1.8 | |
| nathan_haug | filefield_sources | 7.x-1.x | |
| drupal | drupal | - | |
| nathan_haug | filefield_sources | 6.x-1.0 | |
| nathan_haug | filefield_sources | 6.x-1.1 | |
| nathan_haug | filefield_sources | 6.x-1.2 | |
| nathan_haug | filefield_sources | 6.x-1.3 | |
| nathan_haug | filefield_sources | 6.x-1.4 | |
| nathan_haug | filefield_sources | 6.x-1.5 | |
| nathan_haug | filefield_sources | 6.x-1.6 | |
| nathan_haug | filefield_sources | 6.x-1.7 | |
| nathan_haug | filefield_sources | 6.x-1.8 | |
| drupal | drupal | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.2:beta1:*:*:*:*:*:*",
"matchCriteriaId": "C272DA32-518F-4401-97F2-53BD096D6799",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2F3A8434-FCEA-4654-BD19-3C7E6626A70D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1560CFC5-72AF-425C-A6F1-E56192C0327C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "8A9973B0-C6D8-4DD7-8E7D-67E5AE82654E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "066913EE-AB15-43DB-B59A-DD2EAE88D2C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "4E2EAEF9-0ABF-4129-8305-BBBF80E416D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E540EF52-7769-429A-8DA9-3E98E0C236BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.x:dev:*:*:*:*:*:*",
"matchCriteriaId": "3CEB17CA-912B-468D-B659-1E9C9CE5675B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F8B1170D-AD33-4C7A-892D-63AC71B032CF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A67B47CB-0BDD-4A44-A356-28FFE1FB3113",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C9EDE6AE-FF05-41FC-853D-87E39AF83D75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8118B201-35B5-45F5-9484-D7B14CA2E00A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F0AE743E-186F-4ACB-82DC-491DCFE1AA5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "958D06E8-5DE8-4B40-83FE-E1669C888B7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "3AC75C81-97AE-4201-AA3C-D7114AEFC3C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D3A5D39C-F03B-4FBA-9CB4-0CE5A3DC6FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "82A08A9E-D65E-499D-8EEF-4BE70C76211F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "60A698B0-15A5-4F79-B9B1-D15F8D5F6FDF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F8B1170D-AD33-4C7A-892D-63AC71B032CF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9 for Drupal does not properly check file permissions, which allows remote authenticated users to read arbitrary files by attaching a file."
},
{
"lang": "es",
"value": "El m\u00f3dulo FileField Sources 6.x-1.x anterior a 6.x-1.9 y 7.x-1.x anterior a 7.x-1.9 para Drupal no comprueba debidamente permisos de archivos, lo que permite a usuarios remotos autenticados leer archivos arbitrarios al ajuntar un archivo."
}
],
"id": "CVE-2013-4502",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-05-13T15:55:04.140",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://seclists.org/oss-sec/2013/q4/210"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "https://drupal.org/node/2124217"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "https://drupal.org/node/2124219"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://drupal.org/node/2124241"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/oss-sec/2013/q4/210"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://drupal.org/node/2124217"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://drupal.org/node/2124219"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://drupal.org/node/2124241"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2012-5538
Vulnerability from fkie_nvd - Published: 2012-12-03 21:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has "Reference existing" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| nathan_haug | filefield_sources | 6.x-1.0 | |
| nathan_haug | filefield_sources | 6.x-1.1 | |
| nathan_haug | filefield_sources | 6.x-1.2 | |
| nathan_haug | filefield_sources | 6.x-1.3 | |
| nathan_haug | filefield_sources | 6.x-1.4 | |
| nathan_haug | filefield_sources | 6.x-1.5 | |
| nathan_haug | filefield_sources | 6.x-1.x | |
| nathan_haug | filefield_sources | 7.x-1.2 | |
| nathan_haug | filefield_sources | 7.x-1.3 | |
| nathan_haug | filefield_sources | 7.x-1.4 | |
| nathan_haug | filefield_sources | 7.x-1.5 | |
| nathan_haug | filefield_sources | 7.x-1.x | |
| drupal | drupal | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A67B47CB-0BDD-4A44-A356-28FFE1FB3113",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C9EDE6AE-FF05-41FC-853D-87E39AF83D75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8118B201-35B5-45F5-9484-D7B14CA2E00A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F0AE743E-186F-4ACB-82DC-491DCFE1AA5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "958D06E8-5DE8-4B40-83FE-E1669C888B7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "3AC75C81-97AE-4201-AA3C-D7114AEFC3C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:6.x-1.x:dev:*:*:*:*:*:*",
"matchCriteriaId": "F253681F-56D8-4D34-BD74-3E9A6653972B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.2:beta1:*:*:*:*:*:*",
"matchCriteriaId": "C272DA32-518F-4401-97F2-53BD096D6799",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2F3A8434-FCEA-4654-BD19-3C7E6626A70D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1560CFC5-72AF-425C-A6F1-E56192C0327C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "8A9973B0-C6D8-4DD7-8E7D-67E5AE82654E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nathan_haug:filefield_sources:7.x-1.x:dev:*:*:*:*:*:*",
"matchCriteriaId": "3CEB17CA-912B-468D-B659-1E9C9CE5675B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F8B1170D-AD33-4C7A-892D-63AC71B032CF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has \"Reference existing\" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en el m\u00f3dulo FileField v6.x-1.x antes de v6.x-1.6 y v7.x-1.x antes de v7.x-1.6 para Drupal, cuando el campo tiene fuente \"Referencia existente\" activado, permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML a trav\u00e9s del nombre de archivo de un archivo cargado."
}
],
"id": "CVE-2012-5538",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-12-03T21:55:02.003",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://drupal.org/node/1789300"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://drupal.org/node/1789302"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://drupal.org/node/1789306"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2012/11/20/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://drupal.org/node/1789300"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://drupal.org/node/1789302"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://drupal.org/node/1789306"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/11/20/4"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2013-4502 (GCVE-0-2013-4502)
Vulnerability from cvelistv5 – Published: 2014-05-13 15:00 – Updated: 2024-08-06 16:45
VLAI?
Summary
The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9 for Drupal does not properly check file permissions, which allows remote authenticated users to read arbitrary files by attaching a file.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:45:14.740Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://drupal.org/node/2124241"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://drupal.org/node/2124219"
},
{
"name": "[oss-security] 20131103 Re: CVE request for Drupal contributed modules",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2013/q4/210"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://drupal.org/node/2124217"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-10-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9 for Drupal does not properly check file permissions, which allows remote authenticated users to read arbitrary files by attaching a file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-05-13T14:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://drupal.org/node/2124241"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://drupal.org/node/2124219"
},
{
"name": "[oss-security] 20131103 Re: CVE request for Drupal contributed modules",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2013/q4/210"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://drupal.org/node/2124217"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-4502",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9 for Drupal does not properly check file permissions, which allows remote authenticated users to read arbitrary files by attaching a file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://drupal.org/node/2124241",
"refsource": "MISC",
"url": "https://drupal.org/node/2124241"
},
{
"name": "https://drupal.org/node/2124219",
"refsource": "CONFIRM",
"url": "https://drupal.org/node/2124219"
},
{
"name": "[oss-security] 20131103 Re: CVE request for Drupal contributed modules",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2013/q4/210"
},
{
"name": "https://drupal.org/node/2124217",
"refsource": "CONFIRM",
"url": "https://drupal.org/node/2124217"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-4502",
"datePublished": "2014-05-13T15:00:00",
"dateReserved": "2013-06-12T00:00:00",
"dateUpdated": "2024-08-06T16:45:14.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-5538 (GCVE-0-2012-5538)
Vulnerability from cvelistv5 – Published: 2012-12-03 21:00 – Updated: 2024-09-16 17:37
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has "Reference existing" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:05:47.400Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/1789300"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://drupal.org/node/1789306"
},
{
"name": "[oss-security] 20121120 Re: CVE Request for Drupal Contributed Modules",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/11/20/4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/1789302"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has \"Reference existing\" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-12-03T21:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/1789300"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://drupal.org/node/1789306"
},
{
"name": "[oss-security] 20121120 Re: CVE Request for Drupal Contributed Modules",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/11/20/4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/1789302"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2012-5538",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has \"Reference existing\" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://drupal.org/node/1789300",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/1789300"
},
{
"name": "http://drupal.org/node/1789306",
"refsource": "MISC",
"url": "http://drupal.org/node/1789306"
},
{
"name": "[oss-security] 20121120 Re: CVE Request for Drupal Contributed Modules",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/11/20/4"
},
{
"name": "http://drupal.org/node/1789302",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/1789302"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-5538",
"datePublished": "2012-12-03T21:00:00Z",
"dateReserved": "2012-10-24T00:00:00Z",
"dateUpdated": "2024-09-16T17:37:40.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-4502 (GCVE-0-2013-4502)
Vulnerability from nvd – Published: 2014-05-13 15:00 – Updated: 2024-08-06 16:45
VLAI?
Summary
The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9 for Drupal does not properly check file permissions, which allows remote authenticated users to read arbitrary files by attaching a file.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:45:14.740Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://drupal.org/node/2124241"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://drupal.org/node/2124219"
},
{
"name": "[oss-security] 20131103 Re: CVE request for Drupal contributed modules",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2013/q4/210"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://drupal.org/node/2124217"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-10-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9 for Drupal does not properly check file permissions, which allows remote authenticated users to read arbitrary files by attaching a file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-05-13T14:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://drupal.org/node/2124241"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://drupal.org/node/2124219"
},
{
"name": "[oss-security] 20131103 Re: CVE request for Drupal contributed modules",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2013/q4/210"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://drupal.org/node/2124217"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-4502",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9 for Drupal does not properly check file permissions, which allows remote authenticated users to read arbitrary files by attaching a file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://drupal.org/node/2124241",
"refsource": "MISC",
"url": "https://drupal.org/node/2124241"
},
{
"name": "https://drupal.org/node/2124219",
"refsource": "CONFIRM",
"url": "https://drupal.org/node/2124219"
},
{
"name": "[oss-security] 20131103 Re: CVE request for Drupal contributed modules",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2013/q4/210"
},
{
"name": "https://drupal.org/node/2124217",
"refsource": "CONFIRM",
"url": "https://drupal.org/node/2124217"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-4502",
"datePublished": "2014-05-13T15:00:00",
"dateReserved": "2013-06-12T00:00:00",
"dateUpdated": "2024-08-06T16:45:14.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-5538 (GCVE-0-2012-5538)
Vulnerability from nvd – Published: 2012-12-03 21:00 – Updated: 2024-09-16 17:37
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has "Reference existing" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:05:47.400Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/1789300"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://drupal.org/node/1789306"
},
{
"name": "[oss-security] 20121120 Re: CVE Request for Drupal Contributed Modules",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/11/20/4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/1789302"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has \"Reference existing\" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-12-03T21:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/1789300"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://drupal.org/node/1789306"
},
{
"name": "[oss-security] 20121120 Re: CVE Request for Drupal Contributed Modules",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/11/20/4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/1789302"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2012-5538",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has \"Reference existing\" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://drupal.org/node/1789300",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/1789300"
},
{
"name": "http://drupal.org/node/1789306",
"refsource": "MISC",
"url": "http://drupal.org/node/1789306"
},
{
"name": "[oss-security] 20121120 Re: CVE Request for Drupal Contributed Modules",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/11/20/4"
},
{
"name": "http://drupal.org/node/1789302",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/1789302"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-5538",
"datePublished": "2012-12-03T21:00:00Z",
"dateReserved": "2012-10-24T00:00:00Z",
"dateUpdated": "2024-09-16T17:37:40.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}