Description

The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "#access" set to FALSE in the server-side form definition.

Remediation

References

CVE-2016-3165

Related Vulnerabilities

WordPress Plugin Two Factor Authentication Cross-Site Request Forgery (1.3.12)

MediaWiki Improper Encoding or Escaping of Output Vulnerability (CVE-2020-10960)

MySQL CVE-2018-2612 Vulnerability (CVE-2018-2612)

WordPress Plugin Formidable Forms-Contact Form, Survey, Quiz, Calculator & Custom Form Builder Cross-Site Scripting (5.0.06)

EspoCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14350)

Severity

High

Classification

CVE-2016-3165 CWE-284 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities