Description

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."

Remediation

References

CVE-2016-3168

Related Vulnerabilities

Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-0010)

Jenkins Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2023-43497)

MyBB CVE-2008-3070 Vulnerability (CVE-2008-3070)

Oracle JRE CVE-2013-2417 Vulnerability (CVE-2013-2417)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-47797)

Severity

Medium

Classification

CVE-2016-3168 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities