Description
The core upload module in Drupal 5.x before 5.11 allows remote authenticated users to bypass intended access restrictions and read "files attached to content" via unknown vectors.
References
- 32198 third-party-advisory
- http://drupal.org/node/318706
- 32200 third-party-advisory
- drupal-uploadmodule-security-bypass(45758) vdb-entry
- [oss-security] 20081021 CVE req: drupal < 5.11/6.5 mailing-list