---
title: "CVE-2014-5020\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2014-5020?format=md
keywords: index, follow
---

# CVE-2014-5020

Publication date 22 July 2014

Last updated 24 July 2024

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

Toggle side navigation

## Description

The File module in Drupal 7.x before 7.29 does not properly check
permissions to view files, which allows remote authenticated users with
certain permissions to bypass intended restrictions and read files by
attaching the file to content with a file field.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| drupal7 | 26.04 LTS resolute | Not in release |
| 25.10 questing | Not in release |
| 25.04 plucky | Not in release |
| 24.10 oracular | Not in release |
| 24.04 LTS noble | Not in release |
| 23.10 mantic | Not in release |
| 23.04 lunar | Not in release |
| 22.10 kinetic | Not in release |
| 22.04 LTS jammy | Not in release |
| 20.04 LTS focal | Not in release |
| 19.04 disco | Not in release |
| 18.10 cosmic | Not in release |
| 18.04 LTS bionic | Not in release |
| 17.10 artful | Not affected |
| 17.04 zesty | Not affected |
| 16.10 yakkety | Not affected |
| 16.04 LTS xenial | Not affected |
| 15.10 wily | Not affected |
| 15.04 vivid | Not affected |
| 14.10 utopic | Not affected |
| 14.04 LTS trusty | Vulnerable |
| 12.04 LTS precise | Ignored end of life |
| 10.04 LTS lucid | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5020)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-5020)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2014-5020)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2014-5020)

### Other references

* <https://www.drupal.org/SA-CORE-2014-003>
* <http://www.debian.org/security/2014/dsa-2983>
* <https://www.cve.org/CVERecord?id=CVE-2014-5020>