Description
The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors.
References
- http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html
- [oss-security] 20130130 Re: CVE mailing-list
- 20130116 [Security-news] SA-CORE-2013-001 - Drupal core - Multiple vulnerabilities mailing-list
- https://drupal.org/SA-CORE-2013-001
- 51717 third-party-advisory