Vulnerability advisory

GHSA-69g8-g9jq-74v7

Drupal arbitrary code execution

Published May 17, 2022Updated Apr 23, 2024OSV record ↗

Also known as CVE-2016-3171

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

drupal/core Packagist

All drupal/core advisories →

Affected	Fixed in
`6.0` to before 6.38	`6.38`Advisories →

drupal/drupal Packagist

All drupal/drupal advisories →

Affected	Fixed in
`6.0` to before 6.38	`6.38`Advisories →

Description

Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2016-3171 ↗
Webgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3171.yaml ↗
Webgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3171.yaml ↗
Packagegithub.com/drupal/core ↗
Webwww.drupal.org/SA-CORE-2016-001 ↗
Webwww.debian.org/security/2016/dsa-3498 ↗
Webwww.openwall.com/lists/oss-security/2016/02/24/19 ↗
Webwww.openwall.com/lists/oss-security/2016/03/15/10 ↗