Vulnerability advisory

GHSA-frqf-9qr4-6vxf

Drupal Saving user accounts can sometimes grant the user all roles

Published May 17, 2022Updated Apr 23, 2024OSV record ↗

Also known as CVE-2016-6211

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

drupal/core Packagist

All drupal/core advisories →

Affected	Fixed in
`7.0` to before 7.44	`7.44`Advisories →

drupal/drupal Packagist

All drupal/drupal advisories →

Affected	Fixed in
`7.0` to before 7.44	`7.44`Advisories →

Description

The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2016-6211 ↗
Webgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-6211.yaml ↗
Webgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-6211.yaml ↗
Packagegithub.com/drupal/core ↗
Webwww.drupal.org/SA-CORE-2016-002 ↗
Webwww.debian.org/security/2016/dsa-3604 ↗
Webwww.openwall.com/lists/oss-security/2016/07/13/4 ↗
Webwww.openwall.com/lists/oss-security/2016/07/13/7 ↗
Webwww.securityfocus.com/bid/91230 ↗