CVE-2016-3168
At a glance Severity Not available EPSS EPSS 2.47 % · percentile 84 (2026-10-27) State PUBLISHED Published 2016-04-12 Updated 2024-08-05 Assigner mitre NVD status Modified Description The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."
Scores Version Score Vector Scored by CVSS 3.0 MEDIUM 6.4 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 2.0 HIGH 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
Advisories
European references
Affected configurations (NVD CPE) cpe:2.3:a:drupal:drupal:6.0:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.0:beta1:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.0:beta2:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.0:beta3:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.0:beta4:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.0:dev:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.0:rc1:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.0:rc2:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.0:rc3:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.0:rc4:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.1:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.2:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.3:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.4:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.5:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.6:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.7:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.8:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.9:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.10:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.11:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.12:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.13:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.14:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.15:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.16:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.17:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.18:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.19:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.20:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.21:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.22:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.23:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.24:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.25:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.26:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.27:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.28:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.29:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:6.30:*:*:*:*:*:*:*+67 more Affected products Product Versions affected n/a
References
Sources
