Description
When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.
Remediation
References
Related Vulnerabilities
WordPress Plugin HTTP Headers Multiple Vulnerabilities (1.9.1)
WordPress Plugin Are You a Human-The Fun Spam Blocker Cross-Site Scripting (1.4.32)
WordPress Plugin FireCask Like & Share Button Cross-Site Scripting (1.1.5)
Sqlite Out-of-bounds Read Vulnerability (CVE-2019-9936)
Oracle Database Server CVE-2010-0911 Vulnerability (CVE-2010-0911)