Vulnerability advisory

GHSA-fmqh-2j2x-vgp3

Drupal Unprivileged access to config export

Published May 17, 2022Updated Dec 6, 2024OSV record ↗

Also known as CVE-2016-7572

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected versions

drupal/core Packagist

All drupal/core advisories →

Affected Fixed in

8.0 to before 8.1.10 8.1.10Advisories →

Affected	Fixed in
`8.0` to before 8.1.10	`8.1.10`Advisories →
Also listed as affected (35) `8.0.0` `8.0.0-beta10` `8.0.0-beta11` `8.0.0-beta12` `8.0.0-beta13` `8.0.0-beta14` `8.0.0-beta15` `8.0.0-beta16` `8.0.0-beta6` `8.0.0-beta7` `8.0.0-beta8` `8.0.0-beta9` `8.0.0-rc1` `8.0.0-rc2` `8.0.0-rc3` `8.0.0-rc4` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9`

Also listed as affected (35)

drupal/drupal Packagist

All drupal/drupal advisories →

Affected Fixed in

8.0 to before 8.1.10 8.1.10Advisories →

Affected	Fixed in
`8.0` to before 8.1.10	`8.1.10`Advisories →
Also listed as affected (41) `8.0.0` `8.0.0-alpha14` `8.0.0-alpha15` `8.0.0-beta1` `8.0.0-beta10` `8.0.0-beta11` `8.0.0-beta12` `8.0.0-beta13` `8.0.0-beta14` `8.0.0-beta15` `8.0.0-beta16` `8.0.0-beta2` `8.0.0-beta3` `8.0.0-beta4` `8.0.0-beta5` `8.0.0-beta6` `8.0.0-beta7` `8.0.0-beta9` `8.0.0-rc1` `8.0.0-rc2` `8.0.0-rc3` `8.0.0-rc4` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9`

Also listed as affected (41)

Description

The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2016-7572 ↗
Webgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7572.yaml ↗
Webgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7572.yaml ↗
Packagegithub.com/drupal/core ↗
Webwww.drupal.org/SA-CORE-2016-004 ↗
Webwww.securityfocus.com/bid/93101 ↗
Webwww.securitytracker.com/id/1036886 ↗