{"id":"CVE-2014-5020","aliases":["DSA-2983-1","EUVD-2014-4919","GHSA-fh8c-mghq-6w46","MGASA-2014-0322","UBUNTU-CVE-2014-5020"],"status":"published","title":"The File module in Drupal 7.x before 7.29 does not properly check permissions to view files,...","description":"The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field.","severity":{"version":"2.0","score":4.9,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01323,"percentile":0.71078,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2014-07-20T00:00:00Z","modified":"2026-06-17T00:10:56Z","affected":[{"source":"osv","ecosystem":"Debian:7","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14-2+deb7u5"}]}],"versions":["7.14-2","7.14-2+deb7u1","7.14-2+deb7u1~bpo60+1","7.14-2+deb7u2","7.14-2+deb7u2~bpo60+1","7.14-2+deb7u3","7.14-2+deb7u4","7.14-2+deb7u4~bpo60+1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:3","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29-1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29-1.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1","7.26-1ubuntu0.1+esm2","7.26-1ubuntu0.1+esm3"]}],"products":[{"vendor":"drupal","product":"drupal"}],"references":[{"url":"http://www.debian.org/security/2014/dsa-2983","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","report"]},{"url":"https://www.drupal.org/SA-CORE-2014-003","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5020"},{"url":"https://github.com/advisories/GHSA-fh8c-mghq-6w46"},{"url":"https://advisories.mageia.org/MGASA-2014-0322.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13271","tags":["report"]},{"url":"https://drupal.org/SA-CORE-2014-002","tags":["web"]},{"url":"https://drupal.org/SA-CORE-2014-003","tags":["web"]},{"url":"https://drupal.org/drupal-7.27","tags":["web"]},{"url":"https://drupal.org/drupal-7.27-release-notes","tags":["web"]},{"url":"https://drupal.org/drupal-7.28","tags":["web"]},{"url":"https://drupal.org/drupal-7.28-release-notes","tags":["web"]},{"url":"https://drupal.org/drupal-7.29","tags":["web"]},{"url":"https://drupal.org/drupal-7.29-release-notes","tags":["web"]},{"url":"https://www.debian.org/security/2014/dsa-2913","tags":["web"]},{"url":"https://www.debian.org/security/2014/dsa-2983","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-5020","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-5020","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-5020","description":"The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field.","status":"published","published":"2014-07-22T14:00:00Z","modified":"2024-09-16T18:08:33.2Z","updated_at":"2026-11-02T14:33:41.889751Z"}],"euvd":[{"id":"EUVD-2014-4919","description":"The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field.","status":"published","published":"2014-07-22T14:00:00Z","modified":"2024-09-16T18:08:33Z","updated_at":"2026-11-03T00:55:35.370742Z"}],"ghsa":[{"id":"GHSA-fh8c-mghq-6w46","title":"The File module in Drupal 7.x before 7.29 does not properly check permissions to view files,...","description":"The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field.","status":"published","published":"2022-05-17T04:39:24Z","modified":"2023-01-28T05:02:15Z","updated_at":"2026-11-02T14:43:44.921454Z"}],"nvd":[{"id":"CVE-2014-5020","description":"The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field.","status":"published","published":"2014-07-22T14:55:10.05Z","modified":"2026-06-17T00:10:56.073Z","cvss":[{"version":"2.0","score":4.9,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:54.827864Z"}],"osv":[{"id":"DSA-2983-1","title":"drupal7 - security update","status":"published","published":"2014-07-20T00:00:00Z","modified":"2026-03-09T01:18:06.733893Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0322","title":"Updated drupal packages fix security vulnerabilities","description":"An information disclosure vulnerability was discovered in Drupal before 7.27.\nWhen pages are cached for anonymous users, form state may leak between\nanonymous users. Sensitive or private information recorded for one anonymous\nuser could thus be disclosed to other users interacting with the same form at\nthe same time (CVE-2014-2983).\n\nMultiple security issues in Drupal before 7.29, including a denial of service\nissue, an access bypass issue in the File module, and multiple cross-site\nscripting issues (CVE-2014-5019, CVE-2014-5020, CVE-2014-5021, CVE-2014-5022).\n\nDrupal has been updated to version 7.29, fixing this and other bugs.\n","status":"published","published":"2014-08-07T17:01:33Z","modified":"2026-04-16T06:25:32.393736246Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2014-5020","description":"The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field.","status":"published","published":"2014-07-22T14:55:00Z","modified":"2025-09-08T16:43:12Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}