CVE-2009-3207 The ImageCache module 5.x before 5.x-2.5 and 6.x before 6.x-2.0-beta10, a module for Drupal, when the private file system is used, does not properly perform access control for derivative images, which...
MediumCVSS 6.8
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ImageCache module 5.x before 5.x-2.5 and 6.x before 6.x-2.0-beta10, a module for Drupal, when the private file system is used, does not properly perform access control for derivative images, which allows remote attackers to view arbitrary images via a request that specifies an image's filename.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drewish imagecache | = 5.x-1.0 | No fix listed |
| drewish imagecache | = 5.x-1.1 | No fix listed |
| drewish imagecache | = 5.x-1.2 | No fix listed |
| drewish imagecache | = 5.x-1.3 | No fix listed |
| drewish imagecache | = 5.x-1.4 | No fix listed |
| drewish imagecache | = 5.x-1.5 | No fix listed |
| drewish imagecache | = 5.x-1.6 | No fix listed |
| drewish imagecache | = 5.x-1.7 | No fix listed |
| drewish imagecache | = 5.x-1.x-dev | No fix listed |
| drewish imagecache | = 5.x-2.0 | No fix listed |
| drewish imagecache | = 5.x-2.0-alpha | No fix listed |
| drewish imagecache | = 5.x-2.0-beta | No fix listed |
| drewish imagecache | = 5.x-2.0-rc1 | No fix listed |
| drewish imagecache | = 5.x-2.0-rc2 | No fix listed |
| drewish imagecache | = 5.x-2.1 | No fix listed |
| drewish imagecache | = 5.x-2.2 | No fix listed |
| drewish imagecache | = 5.x-2.3 | No fix listed |
| drewish imagecache | = 5.x-2.4 | No fix listed |
| drewish imagecache | = 5.x-2.x-dev | No fix listed |
| drewish imagecache | = 6.x-1.0-alpha1 | No fix listed |
| drewish imagecache | = 6.x-1.0-alpha2 | No fix listed |
| drewish imagecache | = 6.x-2.0-beta1 | No fix listed |
| drewish imagecache | = 6.x-2.0-beta2 | No fix listed |
| drewish imagecache | = 6.x-2.0-beta3 | No fix listed |
| drewish imagecache | = 6.x-2.0-beta4 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| drewish imagecache | = 6.x-2.0-beta5 | No fix listed |
| drewish imagecache | = 6.x-2.0-beta6 | No fix listed |
| drewish imagecache | = 6.x-2.0-beta7 | No fix listed |
| drewish imagecache | = 6.x-2.0-beta8 | No fix listed |
| drewish imagecache | = 6.x-2.0-beta9 | No fix listed |
| drewish imagecache | = 6.x-2.x-dev | No fix listed |
References
- drupal.org exploit patch
- drupal.org patch vendor-advisory
- drupal.org patch vendor-advisory
- drupal.org patch vendor-advisory
- 36412 third-party-advisory vendor-advisory
- imagecache-images-security-bypass(52595) vdb-entry