Description

The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.

Remediation

References

CVE-2016-7572

Related Vulnerabilities

Squid Missing Release of Memory after Effective Lifetime Vulnerability (CVE-2021-28652)

Apache HTTP Server URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-10098)

Chamilo Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2018-1999019)

WordPress Plugin NextGEN Gallery-WordPress Gallery Arbitrary File Upload (2.1.10)

WordPress Plugin Landing Page Builder-Lead Page-Optin Page-Squeeze Page-WordPress Landing Pages Unspecified Vulnerability (1.4.1)

Severity

Medium

Classification

CVE-2016-7572 CWE-264 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities