Description

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."

Remediation

References

CVE-2016-3168

Related Vulnerabilities

WordPress Ultimate Member Plugin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-1208)

OpenSSL Use of Insufficiently Random Values Vulnerability (CVE-2019-1549)

phpMyAdmin 7PK - Security Features Vulnerability (CVE-2015-7873)

Java Unspesificed Vulnerability (CVE-2019-2821)

WordPress Plugin Events Manager Extended Multiple HTML Injection Vulnerabilities (3.1.2)

Severity

Medium

Classification

CVE-2016-3168 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities