GitHub Advisoryadvisory · Packagist

GHSA-4gh5-3hqj-x3pj Drupal Form API ignores access restrictions on submit buttons

HIGH Published 2022-05-17 Modified 2024-04-23 Official page ↗
Aliases
CVE-2016-3165
Ecosystem
Packagist
Packages
drupal/core, drupal/drupal
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-284
Reviewed
2024-04-23

Affected packages

• Packagist drupal/core: >= 6.0, < 6.38 → fixed in 6.38 • Packagist drupal/drupal: >= 6.0, < 6.38 → fixed in 6.38

Description

The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "#access" set to FALSE in the server-side form definition.

Related

Alias · CVE (1)

  • CVE-2016-3165 The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References