GitHub Advisoryadvisory · Packagist
GHSA-fmqh-2j2x-vgp3 Drupal Unprivileged access to config export
MEDIUM
Official page ↗
- Aliases
- CVE-2016-7572
- Ecosystem
- Packagist
- Packages
- drupal/core, drupal/drupal
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Reviewed
- 2024-04-23
Affected packages
• Packagist drupal/core: >= 8.0, < 8.1.10 → fixed in 8.1.10
• Packagist drupal/drupal: >= 8.0, < 8.1.10 → fixed in 8.1.10
Description
The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.
Related
Alias · CVE (1)
- CVE-2016-7572 The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-7572 advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7572.yaml web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7572.yaml web
- https://github.com/drupal/core package
- https://www.drupal.org/SA-CORE-2016-004 web
- http://www.securityfocus.com/bid/93101 web
- http://www.securitytracker.com/id/1036886 web