CVE-2016-3168: Drupal Reflected file download vulnerability
Summary
CVE-2016-3168: Drupal Reflected file download vulnerability. Affects drupal/core across 2 version ranges.
>= 6.0, < 6.38
>= 7.0, < 7.43
Fixed in 6.38 or 7.43, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The System module in Drupal versions 6.x before 6.38 and 7.x before 7.43 is susceptible to a reflected file download vulnerability. This vulnerability allows remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content.
Vulnerability Detail
The reflected file download vulnerability in Drupal can be exploited by attackers to trick site administrators into downloading and executing malicious files. By crafting a specially crafted URL, an attacker can manipulate the download process to execute arbitrary code on the target system. This can lead to various consequences, including unauthorized access, data leakage, and potential compromise of the entire Drupal installation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.0, < 6.386.38composer require drupal/core:6.38 -
>= 7.0, < 7.437.43composer require drupal/core:7.43
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the System module in Drupal. This can be done by navigating to the module administration page and unchecking the box next to the System module. However, this workaround may impact the functionality of certain features that rely on the System module, so upgrading to the latest version is still strongly recommended.
Conclusion
The Drupal Reflected file download vulnerability (CVE-2016-3168) is a serious security issue that can lead to unauthorized access, data leakage, and potential compromise of the entire Drupal installation. It is crucial to upgrade to the latest version of Drupal to mitigate the risk. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
A reflected file download vulnerability is a type of web application vulnerability where an attacker can manipulate the download process to trick users into downloading and executing malicious files.
This vulnerability can be exploited by crafting a specially crafted URL that triggers the download of a malicious file. When the user clicks on the URL, the file is downloaded and executed, potentially leading to unauthorized access or compromise of the system.
The potential consequences of this vulnerability include unauthorized access to sensitive information, data leakage, and potential compromise of the entire Drupal installation. Attackers can use this vulnerability to execute arbitrary code on the target system.
No, only Drupal versions 6.x before 6.38 and 7.x before 7.43 are affected by this vulnerability. It is recommended to upgrade to the latest version to mitigate the risk.
Yes, the CVSS score for this vulnerability is 6.4, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
