PT-2016-5400 · Drupal · Drupal

Pere Orga · Published 2016-04-12 · Updated 2022-05-17 · CVE-2016-3171

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x before 6.38

Description The issue might allow remote attackers to execute arbitrary code via vectors related to session data truncation when used with certain PHP versions.

Recommendations For Drupal versions 6.x before 6.38, update to version 6.38 or later to resolve the issue.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

CWE-19

Related Identifiers

CVE-2016-3171

GHSA-69G8-G9JQ-74V7

Affected Products

Drupal

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3171.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3171.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-69g8-g9jq-74v7 · Vendor Advisory
• http://debian.org/security/2016/dsa-3498 · Vendor Advisory
• https://drupal.org/SA-CORE-2016-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3171 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3171 · Vendor Advisory
• https://github.com/drupal/core · Note
• http://openwall.com/lists/oss-security/2016/03/15/10 · Note
• http://openwall.com/lists/oss-security/2016/02/24/19 · Note