Description
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
Remediation
References
Related Vulnerabilities
WebLogic CVE-2023-21956 Vulnerability (CVE-2023-21956)
Atlassian Jira CVE-2020-36237 Vulnerability (CVE-2020-36237)
OpenVPN AS Use After Free Vulnerability (CVE-2023-46850)
WordPress Plugin TallyKit Cross-Site Scripting (5.4)
WordPress Plugin WPtouch Multiple Cross-Site Scripting Vulnerabilities (3.7.3)