CVEvulnerability
CVE-2016-7570
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2016-10-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 4.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.
Affected configurations
• drupal drupal 8.0.0
• drupal drupal 8.0.1
• drupal drupal 8.0.2
• drupal drupal 8.0.3
• drupal drupal 8.0.4
• drupal drupal 8.0.5
• drupal drupal 8.0.6
• drupal drupal 8.1.0
• drupal drupal 8.1.1
• drupal drupal 8.1.2
• drupal drupal 8.1.3
• drupal drupal 8.1.4
• drupal drupal 8.1.5
• drupal drupal 8.1.6
• drupal drupal 8.1.7
• drupal drupal 8.1.8
• drupal drupal 8.1.9
Related
Weakness · not in database (1)
References
- http://www.securityfocus.com/bid/93101 Third Party Advisory
- http://www.securitytracker.com/id/1036886 Third Party Advisory
- https://www.drupal.org/SA-CORE-2016-004 Vendor Advisory
- http://www.securityfocus.com/bid/93101 Third Party Advisory
- http://www.securitytracker.com/id/1036886 Third Party Advisory
- https://www.drupal.org/SA-CORE-2016-004 Vendor Advisory