Description

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."

Remediation

References

CVE-2016-3168

Related Vulnerabilities

CubeCart Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3724)

MySQL Other Vulnerability (CVE-2002-1375)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-7742)

MySQL CVE-2020-2759 Vulnerability (CVE-2020-2759)

Liferay Portal CVE-2011-1571 Vulnerability (CVE-2011-1571)

Severity

Medium

Classification

CVE-2016-3168 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities