Project
Filebrowser
Date
Severity
Moderately Critical
Risk Score
10 ∕ 25 AC:Basic/A:Admin/CI:Some/II:None/E:Theoretical/TD:All
Vulnerability
Risk of data exposure
Affected versions
All Drupal 7 versions are affected

Description

The Filebrowser module allows users to browse a list of files in specific directories.

Users with permission to create nodes of type dir_listing are able to expose any directory on the server including system and/or critical files.

This module and its directory listing node type should only be used by users with elevated user access. If restricted access to the directory listing node type cannot be achieved, then the module should be uninstalled and removed from the site.

Reported by

Fixed by

Coordinated by