Reflected File Download Affecting drupal/core package, versions >=6, <6.38 >=7, <7.43
Snyk CVSS
Attack Complexity
High
Privileges Required
High
User Interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
EPSS
0.26% (66th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-DRUPALCORE-70043
- published 15 Feb 2016
- disclosed 15 Feb 2016
- credit Juho Nurminen, David Rothstein, Damien Tournoud, Peter Wolanin, Nate Haug
Introduced: 15 Feb 2016
CVE-2016-3168 Open this link in a new tabHow to fix?
Upgrade drupal/core to version 6.38, 7.43 or higher.
Overview
Affected versions of drupal/core are vulnerable to Reflected File Download.
The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "Reflected File Download."