CVE-2010-3092 File upload in n/a
Authenticated users can bypass file download restrictions by uploading files with similar names due to case-insensitive database handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-3092?
CVE-2010-3092 is a medium-severity vulnerability in Drupal Drupal, published on 21 Sep 2010. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The upload module in Drupal 5.x before 5.23 and 6.x before 6.18 does not properly support case-insensitive filename handling in a database configuration, which allows remote authenticated users to bypass the intended restrictions on downloading a file by uploading a different file with a similar name.
Weakness: CWE-264
Which versions are affected by CVE-2010-3092?
It affects 1 product.
Products include Drupal Drupal.
How do I fix CVE-2010-3092?
Upgrade to a fixed version.
Is CVE-2010-3092 being exploited?
There is no known exploitation of CVE-2010-3092 in the wild and no public exploit code.
Other vulnerabilities in Drupal Drupal
Sources
Also known as GHSA-g749-r93q-q2rq.