The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 3.0 | 6.4 | MEDIUM | CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H |
| Primary | 2.0 | 8.5 | HIGH | AV:N/AC:M/Au:S/C:C/I:C/A:C |
| CWE ID | Type | Source |
|---|---|---|
| CWE-254 | Primary | nvd@nist.gov |
| Hyperlink | Source | Resource |
|---|---|---|
| http://www.debian.org/security/2016/dsa-3498 | cve@mitre.org | N/A |
| http://www.openwall.com/lists/oss-security/2016/02/24/19 | cve@mitre.org | N/A |
| http://www.openwall.com/lists/oss-security/2016/03/15/10 | cve@mitre.org | N/A |
| https://www.drupal.org/SA-CORE-2016-001 | cve@mitre.org | Patch Vendor Advisory |
| http://www.debian.org/security/2016/dsa-3498 | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| http://www.openwall.com/lists/oss-security/2016/02/24/19 | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| http://www.openwall.com/lists/oss-security/2016/03/15/10 | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| https://www.drupal.org/SA-CORE-2016-001 | af854a3a-2127-422b-91ae-364da2661108 | Patch Vendor Advisory |