Vulnerability advisory

GHSA-h3r9-pjmr-f938

Drupal Brute force amplification attacks via XML-RPC

Published May 17, 2022Updated Apr 23, 2024OSV record ↗

Also known as CVE-2016-3163

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected versions

drupal/core Packagist

All drupal/core advisories →

Affected	Fixed in
`7.0` to before 7.43	`7.43`Advisories →
`6.0` to before 6.38	`6.38`Advisories →

drupal/drupal Packagist

All drupal/drupal advisories →

Affected	Fixed in
`7.0` to before 7.43	`7.43`Advisories →
`6.0` to before 6.38	`6.38`Advisories →

Description

The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2016-3163 ↗
Webgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3163.yaml ↗
Webgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3163.yaml ↗
Packagegithub.com/drupal/core ↗
Webwww.drupal.org/SA-CORE-2016-001 ↗
Webwww.debian.org/security/2016/dsa-3498 ↗
Webwww.openwall.com/lists/oss-security/2016/02/24/19 ↗
Webwww.openwall.com/lists/oss-security/2016/03/15/10 ↗