PT-2016-5392 · Drupal · Drupal

Pere Orga · Published 2016-02-28 · Updated 2022-05-17 · CVE-2016-3163

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x through 6.37 Drupal versions 7.x through 7.42

Description The XML-RPC system might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method.

Recommendations For Drupal versions 6.x through 6.37, update to version 6.38 or later. For Drupal versions 7.x through 7.42, update to version 7.43 or later.

Exploit

Fix

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2016-3163

DSA-3498-1

GHSA-H3R9-PJMR-F938

Affected Products

Drupal

References · 14

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3163.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3163.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-3163 · Security Note
• http://debian.org/security/2016/dsa-3498 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h3r9-pjmr-f938 · Vendor Advisory
• https://drupal.org/SA-CORE-2016-001 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3163 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3498-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3163 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-3163 · Security Note
• https://ubuntu.com/security/CVE-2016-3163 · Vendor Advisory
• https://github.com/drupal/core · Note
• http://openwall.com/lists/oss-security/2016/02/24/19 · Note
• http://openwall.com/lists/oss-security/2016/03/15/10 · Note