Drupal Views Statistics Information Disclosure
Summary
CVE-2016-6212: Drupal Views can allow unauthorized users to see Statistics information. Affects drupal/core versions >= 8.0, < 8.1.3. Fixed in 8.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Views is a powerful module in the Drupal content management system that allows users to create, manage, and display dynamic lists of content. It provides a flexible and customizable way to present data from the Drupal database. However, a vulnerability has been discovered in the Views module that can allow unauthorized users to access sensitive Statistics information.
Vulnerability Detail
The vulnerability exists in the Views module versions 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3. It is caused by a failure to properly enforce access restrictions, which can enable remote authenticated users to bypass intended limitations and gain access to sensitive Statistics data. The specific vectors through which this can be exploited are not disclosed.
How To Fix
Minimum fixed version
8.1.3
This is the first release that contains the fix.
composer require drupal/core:8.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided updates to ensure the security of the Drupal Views module.
Conclusion
The Drupal Views module is susceptible to an information disclosure vulnerability that allows unauthorized users to access sensitive Statistics information. To mitigate this risk, it is crucial to update the module to the recommended versions. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
The vulnerability allows unauthorized users to view sensitive Statistics information, which could include data related to user activity, content popularity, and other statistical data.
Drupal websites using the affected versions of the Views module (7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3) are vulnerable to this issue.
No specific exploits have been disclosed for this vulnerability at the time of this report. However, it is crucial to apply the recommended updates to mitigate the risk.
Yes, remote authenticated users can exploit this vulnerability if they have the necessary permissions to access the Views module and its associated functionality.
Yes, the CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
