CVE-2011-2726 Missing authorization in drupal core
Non-privileged users can download private files attached to comments on restricted nodes if they know the direct URL.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2011-2726?
CVE-2011-2726 is a high-severity missing authorization vulnerability in Debian Debian Linux, published on 15 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied access, non-privileged users can still download the file attached to the comment if they know or guess its direct URL.
Weakness: CWE-863
Which versions are affected by CVE-2011-2726?
It affects 4 products.
Products include Debian Debian Linux, Drupal Drupal, Fedoraproject Fedora, Redhat Enterprise Linux.
How do I fix CVE-2011-2726?
No fix has been published for CVE-2011-2726 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2011-2726 being exploited?
There is no known exploitation of CVE-2011-2726 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CVE-2011-4323, GHSA-ph8m-2h2f-qgr2.