The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 02:49
Type | Values Removed | Values Added |
---|---|---|
References | () http://www.debian.org/security/2016/dsa-3498 - | |
References | () http://www.openwall.com/lists/oss-security/2016/02/24/19 - | |
References | () http://www.openwall.com/lists/oss-security/2016/03/15/10 - | |
References | () https://www.drupal.org/SA-CORE-2016-001 - Patch, Vendor Advisory |
Information
Published : 2016-04-12 15:59
Updated : 2024-11-21 02:49
NVD link : CVE-2016-3168
Mitre link : CVE-2016-3168
CVE.ORG link : CVE-2016-3168
JSON object : View
Products Affected
debian
- debian_linux
drupal
- drupal
CWE
CWE-254
7PK - Security Features