Drupal Reflected file download vulnerability
The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-3168US | medium6.4 | — | ||
The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.debian.org/security/2016/dsa-3498WEB
- http://www.openwall.com/lists/oss-security/2016/02/24/19WEB
- http://www.openwall.com/lists/oss-security/2016/03/15/10WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3168.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3168.yamlWEB
- https://github.com/drupal/corePACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2016-3168ADVISORY
- https://www.drupal.org/SA-CORE-2016-001WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan