CVE-2016-6211: Drupal Saving user accounts can grant all roles
Summary
CVE-2016-6211: Drupal Saving user accounts can sometimes grant the user all roles. Affects drupal/core versions >= 7.0, < 7.44. Fixed in 7.44. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The User module in Drupal 7.x versions before 7.44 is responsible for managing user accounts and their associated roles. User roles determine the permissions and access levels granted to users within the system.
Vulnerability Detail
The vulnerability identified as CVE-2016-6211 affects the User module in Drupal 7.x versions before 7.44. It allows remote authenticated users to gain privileges by exploiting a flaw in contributed or custom code that triggers a rebuild of the user profile form. This vulnerability can be leveraged to grant unauthorized users additional roles, potentially granting them elevated privileges and access to sensitive information. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
7.44
This is the first release that contains the fix.
composer require drupal/core:7.44Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Drupal is not immediately feasible, a temporary workaround can be implemented. This involves reviewing and auditing any contributed or custom code that triggers a rebuild of the user profile form. By ensuring that the code does not grant additional roles to users without proper authorization, the vulnerability can be mitigated. Here is an example of how the code can be modified to prevent the vulnerability:
// Check if the user has the necessary permissions before granting roles
if (user_access('administer users')) {
// Code to rebuild the user profile form
}
Conclusion
The vulnerability in Drupal's User module (CVE-2016-6211) allows remote authenticated users to gain privileges by exploiting a flaw in contributed or custom code that triggers a rebuild of the user profile form. This can result in unauthorized access to sensitive information and the ability to perform actions reserved for higher privileged users. To mitigate this vulnerability, it is recommended to upgrade to Drupal version 7.44 or later. If immediate upgrading is not possible, a temporary workaround involving code review and modification can be implemented. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
The vulnerability allows remote authenticated users to gain privileges and potentially grant themselves additional roles. This can lead to unauthorized access to sensitive information and the ability to perform actions reserved for higher privileged users.
The vulnerability affects Drupal 7.x versions before 7.44. It is recommended to upgrade to version 7.44 or later to mitigate the vulnerability.
Yes, a temporary workaround involves reviewing and auditing any contributed or custom code that triggers a rebuild of the user profile form. By ensuring that the code does not grant additional roles to users without proper authorization, the vulnerability can be mitigated.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
For more information about this vulnerability, you can refer to the CVE-2016-6211 advisory on the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-frqf-9qr4-6vxf/GHSA-frqf-9qr4-6vxf.json
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.