8.1high
CVE-2016-3171
Drupal arbitrary code execution
Also known as GHSA-69g8-g9jq-74v7
Published 10 y ago · modified 4 mo ago · JSON
CVSS
8.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.2%
percentile 88%
Public exploits
0
none known
Summary
Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.
Exploit prediction (EPSS)
3.19% probability of exploitation in the next 30 days, higher than 88% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | drupal/core | >=6.0, <6.38 | 6.38 |
| packagist | drupal/drupal | >=6.0, <6.38 | 6.38 |
Classification
References
- openwall.com /lists/oss-security/2016/02/24/19 · mailing-list, x_refsource_MLIST, x_transferred
- openwall.com /lists/oss-security/2016/03/15/10 · mailing-list, x_refsource_MLIST, x_transferred
- debian.org /security/2016/dsa-3498 · vendor-advisory, x_refsource_DEBIAN, x_transferred
- drupal.org /SA-CORE-2016-001 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-3171 · advisory
- github.com /FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3171.yaml · web
- github.com /FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3171.yaml · web
- github.com /drupal/core · package
Sources
- CVE List: CVE-2016-3171
- GitHub Advisory: GHSA-69g8-g9jq-74v7
- NVD: CVE-2016-3171
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.