CVE-2016-3168

Published Apr 12, 2016

Last updated 9 years ago

Overview

Description
The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."
Source
cve@mitre.org
NVD status
Analyzed

Social media

Hype score
Not currently trending

Risk scores

CVSS 3.0

Type
Primary
Base score
6.4
Impact score
5.9
Exploitability score
0.5
Vector string
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Severity
MEDIUM

CVSS 2.0

Type
Primary
Base score
8.5
Impact score
10
Exploitability score
6.8
Vector string
AV:N/AC:M/Au:S/C:C/I:C/A:C

Weaknesses

nvd@nist.gov
CWE-254

Configurations