CVE: CVE-2009-3781

Export to Word

The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.00989
Percentile: 0.75905

CVSS Scoring

CVSS v2 Score: 7.5

Severity:

Mapped CWE(s)

CWE-862 : Missing Authorization

All CAPEC(s)

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

CAPEC(s) with Mapped TTPs

CAPEC-665: Exploitation of Thunderbolt Protection Flaws
Mapped TTPs:
- T1211 : Exploitation for Defense Evasion
- T1542.002 : Component Firmware
- T1556 : Modify Authentication Process

Mapped ATT&CK TTPs

T1211 : Exploitation for Defense Evasion
Kill Chain: defense-evasion
T1542.002 : Component Firmware
Kill Chain: persistence
T1556 : Modify Authentication Process
Kill Chain: credential-access

Malware

APTs Threat Group Associations

Campaigns

ArcaneDoor

Affected Products

cpe:2.3:a:quicksketch:filefield:6.x-3.1:*:*:*:*:drupal:*:*

← Back to Home