PT-2016-5400 · Drupal · Drupal

Pere Orga · Publicado 2016-04-12 · Atualizado 2022-05-17 · CVE-2016-3171

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x before 6.38

Description The issue might allow remote attackers to execute arbitrary code via vectors related to session data truncation when used with certain PHP versions.

Recommendations For Drupal versions 6.x before 6.38, update to version 6.38 or later to resolve the issue.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

CWE-19

Identificadores relacionados

CVE-2016-3171

GHSA-69G8-G9JQ-74V7

Produtos afetados

Drupal

Referências · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3171.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3171.yaml · Exploit
• https://github.com/drupal/core · Nota
• https://osv.dev/vulnerability/GHSA-69g8-g9jq-74v7 · Aviso do Fabricante
• http://debian.org/security/2016/dsa-3498 · Aviso do Fabricante
• https://drupal.org/SA-CORE-2016-001 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-3171 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-3171 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/03/15/10 · Nota
• http://openwall.com/lists/oss-security/2016/02/24/19 · Nota