vulnwire
6.4med

CVE-2016-3168

Drupal Reflected file download vulnerability

Also known as GHSA-qqxc-cppg-4xp8

Published 10 y ago · modified 4 mo ago · JSON

CVSS
6.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.5%
percentile 85%
Public exploits
0
none known

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."

Exploit prediction (EPSS)

2.47% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.4CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
NVD2.08.5AV:N/AC:M/Au:S/C:C/I:C/A:C
GitHub3.06.4CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
packagistdrupal/core
>=6.0, <6.38
>=7.0, <7.43
6.38
7.43
packagistdrupal/drupal
>=7.0, <7.43
>=6.0, <6.38
7.43
6.38

Classification

Weakness

References

  • openwall.com /lists/oss-security/2016/02/24/19 · mailing-list, x_refsource_MLIST, x_transferred
  • openwall.com /lists/oss-security/2016/03/15/10 · mailing-list, x_refsource_MLIST, x_transferred
  • debian.org /security/2016/dsa-3498 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • drupal.org /SA-CORE-2016-001 · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-3168 · advisory
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3168.yaml · web
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3168.yaml · web
  • github.com /drupal/core · package

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.