Site Documentation Module for Drupal contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when the file system doesn't properly verify the saved file is protected by the private file system, which will disclose structure information to an attacker.

Upgrade to version 6.x-1.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2012-2302 (see also: NVD)
• Vendor Specific News/Changelog Entry: http://drupal.org/node/1546224
• Vendor Specific Advisory URL: http://drupal.org/node/1547686
• Vendor Specific Solution URL: http://drupalcode.org/project/sitedoc.git/commitdiff/521721c
• Packet Storm: http://packetstormsecurity.org/files/112183/Drupal-Site-Documentation-6.x-Information-Disclosure.html
• Other Advisory URL: http://www.openwall.com/lists/oss-security/2012/05/03/1
  http://www.openwall.com/lists/oss-security/2012/05/03/2
• Mail List Post: http://www.openwall.com/lists/oss-security/2012/05/03/1
  http://www.openwall.com/lists/oss-security/2012/05/03/2

• Jakub Suchy - Drupal Security Team