CVE-2008-3745

The Upload module in Drupal 6.x before 6.4 allows remote authenticated users to edit nodes, delete files, and download unauthorized attachments via unspecified vectors.

Date published : 2008-08-27

http://www.securityfocus.com/bid/30689

http://drupal.org/node/295053