PT-2016-5394 · Drupal · Drupal

Damien Tournoud + 2 · Publicado 2016-04-12 · Atualizado 2022-05-17 · CVE-2016-3165

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 6.38

Description The issue concerns the Form API in Drupal, which ignores access restrictions on submit buttons. This might allow remote attackers to bypass intended access restrictions by submitting a form with a button that has #access set to FALSE in the server-side form definition.

Recommendations For versions prior to 6.38, update to version 6.38 or later to resolve the issue.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-3165

GHSA-4GH5-3HQJ-X3PJ

Produtos afetados

Drupal

Referências · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3165.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3165.yaml · Exploit
• https://github.com/drupal/core · Nota
• http://debian.org/security/2016/dsa-3498 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-3165 · Aviso do Fabricante
• https://drupal.org/SA-CORE-2016-001 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-3165 · Nota de Segurança
• http://openwall.com/lists/oss-security/2016/03/15/10 · Nota
• https://osv.dev/vulnerability/GHSA-4gh5-3hqj-x3pj · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/02/24/19 · Nota