High severity7.5NVD Advisory· Published Nov 13, 2019· Updated Jun 16, 2026

CVE-2011-4972

Description

hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct request.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Fckeditor/Fckeditor
cpe:2.3:a:ckeditor:ckeditor:7.x-1.4:*:*:*:*:drupal:*:*
Drupal/CKEditor modulellm-create
Range: 7.x-1.4
Cfmsource/Ckeditor Drupal Modulev5
Range: 7.x-1.4

Patches

Vulnerability mechanics

References

drupal.org/node/1337006nvdPatchThird Party Advisory
www.openwall.com/lists/oss-security/2013/06/04/5nvdMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2013/06/04/7nvdMailing ListThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000