Vulnerability advisory

CVE-2016-6212

Published Sep 9, 2016Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
497914920385b7016ac9c9367e0198530787adf2 through 6204be67bb3c1a0b64991770c27b62dbadb15007	No fix listed
Also listed as affected (100) `7.0` `7.0-alpha1` `7.0-alpha2` `7.0-alpha3` `7.0-alpha4` `7.0-alpha5` `7.0-alpha6` `7.0-alpha7` `7.0-beta1` `7.0-beta2` `7.0-beta3` `7.1` `7.10` `7.11` `7.12` `7.13` `7.14` `7.15` `7.16` `7.17` `7.18` `7.19` `7.2` `7.20` `7.21` `7.22` `7.23` `7.24` `7.25` `7.26` `7.27` `7.28` `7.29` `7.3` `7.30` `7.31` `7.32` `7.33` `7.34` `7.35` `7.36` `7.37` `7.38` `7.39` `7.4` `7.40` `7.41` `7.42` `7.43` `7.5` `7.6` `7.7` `7.8` `7.9` `8.0.0` `8.0.0-alpha14` `8.0.0-alpha15` `8.0.0-beta1` `8.0.0-beta10` `8.0.0-beta11` `8.0.0-beta12` `8.0.0-beta13` `8.0.0-beta14` `8.0.0-beta15` `8.0.0-beta16` `8.0.0-beta2` `8.0.0-beta3` `8.0.0-beta4` `8.0.0-beta6` `8.0.0-beta7` `8.0.0-beta9` `8.0.0-rc1` `8.0.0-rc2` `8.0.0-rc3` `8.0.0-rc4` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.2` `8.0.0-beta5` `8.0-alpha13` `8.0-alpha12` `8.0-alpha11` `8.0-alpha10` `8.0-alpha9` `8.0-alpha8` `8.0-alpha7` `8.0-alpha6` `8.0-alpha5` `8.0-alpha4` `8.0-alpha3` `8.0-alpha2`

Description

The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information via unspecified vectors.

References

Webwww.securityfocus.com/bid/91230 ↗
Advisorywww.openwall.com/lists/oss-security/2016/07/13/4 ↗
Advisorywww.openwall.com/lists/oss-security/2016/07/13/7 ↗
Advisorywww.drupal.org/SA-CORE-2016-002 ↗
Advisorywww.drupal.org/node/2749333 ↗