8.5
CVE-2016-3168
- EPSS 2.48%
- Veröffentlicht 12.04.2016 15:59:05
- Zuletzt bearbeitet 06.05.2026 22:30:45
- Erkennungen
LoginThe System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version 7.0
Debian ≫ Debian Linux Version 8.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.48% | 0.825 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 6.4 | 0.5 | 5.9 |
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
|
| NIST | 8.5 | 6.8 | 10 |
AV:N/AC:M/Au:S/C:C/I:C/A:C
|
http://www.debian.org/security/2016/dsa-3498
http://www.openwall.com/lists/oss-security/2016/02/24/19
http://www.openwall.com/lists/oss-security/2016/03/15/10
https://www.drupal.org/SA-CORE-2016-001