Drupal Unprivileged access to config export
The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2016-7572US | medium4.3 | — | ||
The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended acc… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.securityfocus.com/bid/93101WEB
- http://www.securitytracker.com/id/1036886WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7572.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7572.yamlWEB
- https://github.com/drupal/corePACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2016-7572ADVISORY
- https://www.drupal.org/SA-CORE-2016-004WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan