Description

The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors.

Remediation

References

CVE-2013-0246

Related Vulnerabilities

MySQL CVE-2017-3648 Vulnerability (CVE-2017-3648)

MySQL CVE-2021-2031 Vulnerability (CVE-2021-2031)

WordPress Plugin Payment Form for PayPal Pro SQL Injection (1.1.64)

DOMPurify Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-26870)

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-4975)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2013-0246