Description

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."

Remediation

References

CVE-2016-3168

Related Vulnerabilities

Joomla Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2020-15697)

PHP Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Vulnerability (CVE-2007-0455)

WebLogic Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2019-17359)

PHP-Fusion Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-1807)

WordPress Plugin SEO Ultimate 'wp-admin/post.php' Cross-Site Scripting (6.9.1)

Severity

Medium

Classification

CVE-2016-3168 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities