Vulnerability Details CVE-2010-3092
The upload module in Drupal 5.x before 5.23 and 6.x before 6.18 does not properly support case-insensitive filename handling in a database configuration, which allows remote authenticated users to bypass the intended restrictions on downloading a file by uploading a different file with a similar name.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 42.4%
CVSS Severity
CVSS v2 Score 5.5
Products affected by CVE-2010-3092
-
cpe:2.3:a:drupal:drupal:5.0
-
cpe:2.3:a:drupal:drupal:5.1
-
cpe:2.3:a:drupal:drupal:5.10
-
cpe:2.3:a:drupal:drupal:5.11
-
cpe:2.3:a:drupal:drupal:5.12
-
cpe:2.3:a:drupal:drupal:5.13
-
cpe:2.3:a:drupal:drupal:5.14
-
cpe:2.3:a:drupal:drupal:5.15
-
cpe:2.3:a:drupal:drupal:5.16
-
cpe:2.3:a:drupal:drupal:5.17
-
cpe:2.3:a:drupal:drupal:5.18
-
cpe:2.3:a:drupal:drupal:5.19
-
cpe:2.3:a:drupal:drupal:5.2
-
cpe:2.3:a:drupal:drupal:5.20
-
cpe:2.3:a:drupal:drupal:5.21
-
cpe:2.3:a:drupal:drupal:5.22
-
cpe:2.3:a:drupal:drupal:5.3
-
cpe:2.3:a:drupal:drupal:5.4
-
cpe:2.3:a:drupal:drupal:5.5
-
cpe:2.3:a:drupal:drupal:5.6
-
cpe:2.3:a:drupal:drupal:5.7
-
cpe:2.3:a:drupal:drupal:5.8
-
cpe:2.3:a:drupal:drupal:5.9
-
cpe:2.3:a:drupal:drupal:6.0
-
cpe:2.3:a:drupal:drupal:6.1
-
cpe:2.3:a:drupal:drupal:6.10
-
cpe:2.3:a:drupal:drupal:6.11
-
cpe:2.3:a:drupal:drupal:6.12
-
cpe:2.3:a:drupal:drupal:6.13
-
cpe:2.3:a:drupal:drupal:6.14
-
cpe:2.3:a:drupal:drupal:6.15
-
cpe:2.3:a:drupal:drupal:6.16
-
cpe:2.3:a:drupal:drupal:6.17
-
cpe:2.3:a:drupal:drupal:6.2
-
cpe:2.3:a:drupal:drupal:6.3
-
cpe:2.3:a:drupal:drupal:6.4
-
cpe:2.3:a:drupal:drupal:6.5
-
cpe:2.3:a:drupal:drupal:6.6
-
cpe:2.3:a:drupal:drupal:6.7
-
cpe:2.3:a:drupal:drupal:6.8
-
cpe:2.3:a:drupal:drupal:6.9