CVE-2008-3745

Drupal Upload module < 6.4 - Authenticated Unauthorized Node Edit and File Deletion

Title source: llm
STIX 2.1

Description

The Upload module in Drupal 6.x before 6.4 allows remote authenticated users to edit nodes, delete files, and download unauthorized attachments via unspecified vectors.

References (8)

Core 8
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=459108
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/30689
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31825
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/2392
Patch x_refsource_confirm
http://drupal.org/node/295053
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/44458

Scores

EPSS 0.0094
EPSS Percentile 76.5%

Details

CWE
CWE-264
Status published
Products (5)
drupal/drupal 6.0
drupal/drupal 6.1
drupal/drupal 6.2
drupal/drupal 6.3
drupal/upload_module
Published Aug 27, 2008
Tracked Since Feb 18, 2026