756
VMScore

CVE-2016-3168

Published: 12/04/2016 Updated: 14/04/2016
CVSS v2 Base Score: 8.5 | Impact Score: 10 | Exploitability Score: 6.8
CVSS v3 Base Score: 6.4 | Impact Score: 5.9 | Exploitability Score: 0.5
VMScore: 756
Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C

Vulnerability Summary

The System module in Drupal 6.x prior to 6.38 and 7.x prior to 7.43 might allow remote malicious users to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."

Vulnerable Product Search on Vulmon Subscribe to Product

drupal drupal 7.6

drupal drupal 7.5

drupal drupal 7.4

drupal drupal 7.38

drupal drupal 7.37

drupal drupal 7.23

drupal drupal 7.22

drupal drupal 7.21

drupal drupal 7.20

drupal drupal 7.0

drupal drupal 6.9

drupal drupal 6.8

drupal drupal 6.7

drupal drupal 6.6

drupal drupal 6.5

drupal drupal 6.26

drupal drupal 6.25

drupal drupal 6.24

drupal drupal 6.23

drupal drupal 6.10

drupal drupal 6.1

drupal drupal 6.0

drupal drupal 7.41

drupal drupal 7.40

drupal drupal 7.32

drupal drupal 7.31

drupal drupal 7.30

drupal drupal 7.3

drupal drupal 7.29

drupal drupal 7.28

drupal drupal 7.16

drupal drupal 7.15

drupal drupal 7.14

drupal drupal 7.13

drupal drupal 7.12

drupal drupal 6.33

drupal drupal 6.32

drupal drupal 6.31

drupal drupal 6.30

drupal drupal 6.18

drupal drupal 6.17

drupal drupal 6.16

drupal drupal 6.15

drupal drupal 7.9

drupal drupal 7.7

drupal drupal 7.35

drupal drupal 7.33

drupal drupal 7.27

drupal drupal 7.25

drupal drupal 7.19

drupal drupal 7.17

drupal drupal 7.10

drupal drupal 6.37

drupal drupal 6.36

drupal drupal 6.34

drupal drupal 6.3

drupal drupal 6.28

drupal drupal 6.21

drupal drupal 6.2

drupal drupal 6.13

drupal drupal 6.11

drupal drupal 7.42

drupal drupal 7.x-dev

drupal drupal 7.8

drupal drupal 7.36

drupal drupal 7.34

drupal drupal 7.26

drupal drupal 7.24

drupal drupal 7.2

drupal drupal 7.18

drupal drupal 7.11

drupal drupal 7.1

drupal drupal 6.4

drupal drupal 6.35

drupal drupal 6.29

drupal drupal 6.27

drupal drupal 6.22

drupal drupal 6.20

drupal drupal 6.19

drupal drupal 6.14

drupal drupal 6.12

debian debian linux 8.0

debian debian linux 7.0

Vendor Advisories

Multiple security vulnerabilities have been found in the Drupal content management framework For additional information, please refer to the upstream advisory at wwwdrupalorg/SA-CORE-2016-001 For the oldstable distribution (wheezy), this problem has been fixed in version 714-2+deb7u12 For the stable distribution (jessie), this problem ...