GitHub Advisory DatabaseGHSA-QQXC-CPPG-4XP8Drupal Reflected file download vulnerability
8.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:S/C:C/I:C/A:C
6.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
7.2 High
AI Score
Confidence
High
0.003 Low
EPSS
Percentile
66.2%
The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a “reflected file download vulnerability.”
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| drupal/drupal | lt | 6.38 | |
| drupal/drupal | lt | 7.43 | |
| drupal/core | lt | 7.43 | |
| drupal/core | lt | 6.38 |
References
www.debian.org/security/2016/dsa-3498
www.openwall.com/lists/oss-security/2016/02/24/19
www.openwall.com/lists/oss-security/2016/03/15/10
github.com/advisories/GHSA-qqxc-cppg-4xp8
github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3168.yaml
github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3168.yaml
nvd.nist.gov/vuln/detail/CVE-2016-3168
www.drupal.org/SA-CORE-2016-001
Related
8.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:S/C:C/I:C/A:C
6.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
7.2 High
AI Score
Confidence
High
0.003 Low
EPSS
Percentile
66.2%