vulnwire
4.3med

CVE-2016-7570

Drupal Users without "Administer comments" can set comment visibility on nodes they can edit

Also known as GHSA-6g9h-6v79-w4pc

Published 10 y ago · modified 4 mo ago · JSON

CVSS
4.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.7%
percentile 77%
Public exploits
0
none known

Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.

Exploit prediction (EPSS)

1.68% probability of exploitation in the next 30 days, higher than 77% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.04.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD2.04.0AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub3.04.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
packagistdrupal/drupal
>=8.0.0, <8.1.10
8.1.10
packagistdrupal/core
>=8.0.0, <8.1.10
8.1.10

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls
  • CWE-269 Improper Privilege Management

References

  • drupal.org /SA-CORE-2016-004 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/93101 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1036886 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-7570 · advisory
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7570.yaml · web
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7570.yaml · web
  • github.com /drupal/core · package

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.