Description

The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files.

Remediation

References

CVE-2016-3162

Related Vulnerabilities

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-7835)

Drupal Core 8.7.0 Directory Traversal (8.7.0)

Coppermine Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-7186)

WordPress Plugin Customize Feeds for Twitter Cross-Site Request Forgery (1.8.8)

WordPress Plugin ThinkTwit Cross-Site Scripting (1.7.0)

Severity

High

Classification

CVE-2016-3162 CWE-284 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Tags

Missing Update Known Vulnerabilities