Vulnerability advisory

CVE-2016-3168

Published Apr 12, 2016Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
f8d6bbf44160e6d00e71f0172ecf80e78d0f0d3c through 9ee4a1a2fa3bedb3852d21f2198509c107c48890	No fix listed
Also listed as affected (90) `6.0` `6.1` `6.10` `6.11` `6.12` `6.13` `6.14` `6.15` `6.16` `6.17` `6.18` `6.19` `6.2` `6.20` `6.21` `6.22` `6.23` `6.24` `6.25` `6.26` `6.27` `6.28` `6.29` `6.3` `6.30` `6.31` `6.32` `6.33` `6.34` `6.35` `6.36` `6.37` `6.4` `6.5` `6.6` `6.7` `6.8` `6.9` `7.0` `7.0-alpha1` `7.0-alpha2` `7.0-alpha3` `7.0-alpha4` `7.0-alpha5` `7.0-alpha6` `7.0-alpha7` `7.0-beta1` `7.0-beta2` `7.0-beta3` `7.1` `7.10` `7.11` `7.12` `7.13` `7.14` `7.15` `7.16` `7.17` `7.18` `7.19` `7.2` `7.20` `7.21` `7.22` `7.23` `7.24` `7.25` `7.26` `7.27` `7.28` `7.29` `7.3` `7.30` `7.31` `7.32` `7.33` `7.34` `7.35` `7.36` `7.37` `7.38` `7.4` `7.40` `7.41` `7.42` `7.5` `7.6` `7.7` `7.8` `7.9`

Description

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."

CVE-2016-3168

Affected versions

Repository

Description

References