PT-2016-5397 · Drupal · Drupal

Pere Orga · Publicado 2016-02-28 · Atualizado 2022-05-17 · CVE-2016-3168

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x prior to 6.38 Drupal versions 7.x prior to 7.43

Description The issue might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content.

Recommendations For versions 6.x prior to 6.38, update to version 6.38 or later. For versions 7.x prior to 7.43, update to version 7.43 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

CVE-2016-3168

DSA-3498-1

GHSA-QQXC-CPPG-4XP8

Produtos afetados

Drupal

Referências · 14

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3168.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3168.yaml · Exploit
• https://github.com/drupal/core · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-3168 · Nota de Segurança
• http://debian.org/security/2016/dsa-3498 · Aviso do Fabricante
• https://drupal.org/SA-CORE-2016-001 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3498-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-3168 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-qqxc-cppg-4xp8 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-3168 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3168 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/03/15/10 · Nota
• http://openwall.com/lists/oss-security/2016/02/24/19 · Nota
• https://ubuntu.com/security/CVE-2016-3168 · Aviso do Fabricante