PT-2016-5393 · Drupal · Drupal

Pere Orga · Published 2016-02-28 · Updated 2022-05-17 · CVE-2016-3164

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x through 6.37 Drupal versions 7.x through 7.42 Drupal versions 8.x through 8.0.3

Description The issue allows remote attackers to conduct open redirect attacks by leveraging custom code or a form shown on a 404 error page, related to path manipulation.

Recommendations For Drupal versions 6.x through 6.37, update to version 6.38 or later. For Drupal versions 7.x through 7.42, update to version 7.43 or later. For Drupal versions 8.x through 8.0.3, update to version 8.0.4 or later.

Exploit

Fix

Related Identifiers

CVE-2016-3164

DSA-3498-1

GHSA-836P-6P4J-35CG

Affected Products

Drupal

References · 24

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3164.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3164.yaml · Exploit
• https://cve.org/CVERecord?id=CVE-2016-3164 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3164 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-3164 · Security Note
• https://security-tracker.debian.org/tracker/source-package/drupal7 · Vendor Advisory
• https://drupal.org/SA-CORE-2016-001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3164 · Vendor Advisory
• http://debian.org/security/2016/dsa-3498 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-836p-6p4j-35cg · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3498-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3168 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3163 · Security Note
• https://osv.dev/vulnerability/DSA-3498-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3164 · Vendor Advisory