Drupal Saving user accounts can sometimes grant the user all roles
The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-6211US | high8.8 | — | ||
The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.debian.org/security/2016/dsa-3604WEB
- http://www.openwall.com/lists/oss-security/2016/07/13/4WEB
- http://www.openwall.com/lists/oss-security/2016/07/13/7WEB
- http://www.securityfocus.com/bid/91230WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-6211.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-6211.yamlWEB
- https://github.com/drupal/corePACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2016-6211ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan