Executive Summary

This vulnerability is an information disclosure issue in Drupal 7.x versions prior to 7.1.3 related to the processing of file URIs in File (Field) Paths. Authenticated users can exploit filename-collision uploads to access other users' private files. This happens because the system may provide incorrect file URIs to certain consumers, such as email attachment modules, bypassing the normal access controls that protect private files.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of private files belonging to other users. This means that sensitive or confidential information stored in private files could be exposed to authenticated users who should not have access, potentially leading to privacy breaches or data leaks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated users to disclose other users’ private files due to improper file URI processing and filename-collision uploads in Drupal 7.x prior to 7.1.3. Such unauthorized disclosure of private files can lead to violations of data protection and privacy requirements mandated by standards like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive information.

By bypassing normal access controls on private files, this vulnerability increases the risk of unauthorized data exposure, potentially resulting in non-compliance with regulations that mandate confidentiality and integrity of user data.

Useful 0 Not Useful 0