Description
When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.
Remediation
References
Related Vulnerabilities
phpMyFAQ Other Vulnerability (CVE-2005-3048)
Joomla! Core 4.x.x Multiple Vulnerabilities (4.0.0 - 4.1.0)
Magento CVE-2019-8122 Vulnerability (CVE-2019-8122)
WordPress 4.1.x Denial of Service Vulnerability (4.1 - 4.1.22)
WordPress Plugin Media Library Assistant Multiple Cross-Site Scripting Vulnerabilities (2.73)