GitHub Advisoryadvisory · Packagist

GHSA-69g8-g9jq-74v7 Drupal arbitrary code execution

HIGH Published 2022-05-17 Modified 2024-04-23 Official page ↗
Aliases
CVE-2016-3171
Ecosystem
Packagist
Packages
drupal/core, drupal/drupal
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2024-04-23

Affected packages

• Packagist drupal/core: >= 6.0, < 6.38 → fixed in 6.38 • Packagist drupal/drupal: >= 6.0, < 6.38 → fixed in 6.38

Description

Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.

Related

Alias · CVE (1)

  • CVE-2016-3171 Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References