Brute Force Affecting drupal/core package, versions >=6, <6.38 >=7, <7.43
Snyk CVSS
Attack Complexity
Low
Integrity
High
Threat Intelligence
EPSS
0.35% (72nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-DRUPALCORE-70038
- published 15 Feb 2016
- disclosed 15 Feb 2016
- credit Stéphane Corlosquet
Introduced: 15 Feb 2016
CVE-2016-3163 Open this link in a new tabHow to fix?
Upgrade drupal/core to version 6.38, 7.43 or higher.
Overview
Affected versions of drupal/core are vulnerable to Brute force amplification attacks via XML-RPC.
The XML-RPC system allows a large number of calls to the same method to be made at once, which can be used as an enabling factor in brute force attacks (for example, attempting to determine user passwords by submitting a large number of password variations at once).