Drupal sensitive information disclosure in Drupal/Core
Summary
CVE-2016-3170: Drupal sensitive information disclosure. Affects drupal/core across 2 version ranges.
>= 7.0, < 7.43
>= 8.0, < 8.0.4
Fixed in 7.43 or 8.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal/Core is a widely used open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The User module in Drupal/Core allows users to register, login, and manage their accounts. However, a vulnerability in the "have you forgotten your password" feature of the User module can lead to sensitive information disclosure.
Vulnerability Detail
The vulnerability exists in Drupal 7.x before version 7.43 and Drupal 8.x before version 8.0.4. When the configuration allows using an email address to login and a module permits logging in, remote attackers can exploit the "have you forgotten your password" links to obtain sensitive username information. By leveraging this vulnerability, an attacker can potentially gain unauthorized access to user accounts and perform malicious actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0, < 7.437.43composer require drupal/core:7.43 -
>= 8.0, < 8.0.48.0.4composer require drupal/core:8.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Drupal/Core to the patched versions mentioned above.
Conclusion
The sensitive information disclosure vulnerability in Drupal/Core can have serious consequences, including unauthorized access to user accounts. It is crucial to update Drupal/Core to the patched versions as soon as possible to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal/Core is an open-source content management system (CMS) used for building websites and applications.
The User module in Drupal/Core allows users to register, login, and manage their accounts.
The vulnerability can lead to sensitive username information disclosure, potentially enabling unauthorized access to user accounts.
To fix this vulnerability, update Drupal/Core to version 7.43 or later for Drupal 7.x installations, and version 8.0.4 or later for Drupal 8.x installations.
No, there is no known workaround. Updating Drupal/Core to the patched versions is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
