CVE-2011-2726

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied access, non-privileged users can still download the file attached to the comment if they know or guess its direct URL.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
drupal core	drupal core	7.x before version 7.5

References

http://www.openwall.com/lists/oss-security/2012/03/19/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/03/20/14Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2011-2726Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2726Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-2726Third Party Advisory
https://www.drupal.org/node/1231510Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/03/19/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/03/20/14Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2011-2726Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2726Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-2726Third Party Advisory
https://www.drupal.org/node/1231510Vendor Advisory

Timeline

Published: Nov 15, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-27274.3The (1) templatewrap/templatefoot.php, (2) cmsjs/plugin.js.php, and (3) cmsincludes/cms_plugin_api_link.inc.php scripts in Tribal Tribiq CMS CVE-2011-27284.3The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash CVE-2011-27295.0native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 throug CVE-2011-27307.5VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (E CVE-2011-27315.1Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentic CVE-2011-27324.3CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows r CVE-2011-27337.5EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not prevent reuse of auth CVE-2011-27357.9Multiple buffer overflows in EMC AutoStart 5.3.x and 5.4.x before 5.4.1 allow remote attackers to cause a denial of service (daemon crash) o CVE-2011-27365.0RSA enVision 4.x before 4 SP4 P3 places cleartext administrative credentials in Task Escalation e-mail messages, which allows remote attacke CVE-2011-27375.0RSA enVision 3.x and 4.x before 4 SP4 P3 allows remote attackers to read arbitrary files via unspecified vectors, related to an "arbitrary f CVE-2011-273810.0Multiple unspecified vulnerabilities in Cisco Unified Service Monitor before 8.6, as used in Unified Operations Manager before 8.6 and Cisco CVE-2011-27398.5The file-blocking feature in EMC Documentum eRoom 7.3.x and 7.4.x before 7.4.3.g does not properly restrict the uploading and opening of fil