CVE-2016-3168

MEDIUM6.4EPSS 0.53%

Drupal Reflected file download vulnerability

發布日:2022/5/17修改日:2024/4/23

描述

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."

受影響套件(2)

Packagist/drupal/core>= 6.0, < 6.38
Packagist/drupal/drupal>= 7.0, < 7.43

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM6.4	CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

參考連結(8)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-3168
PATCHhttps://github.com/drupal/core
WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3168.yaml
WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3168.yaml
WEBhttps://www.drupal.org/SA-CORE-2016-001
WEBhttp://www.debian.org/security/2016/dsa-3498
WEBhttp://www.openwall.com/lists/oss-security/2016/02/24/19
WEBhttp://www.openwall.com/lists/oss-security/2016/03/15/10