CVE-2016-3162
CVE-2016-3162
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files.
CVSS 8.1 · High · EPSS 1.6% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
drupal/core Packagist
- Affected ranges
- ECOSYSTEM: ≥ 7.0, < 7.43
Update to 7.43
drupal/core Packagist
- Versions
- 8.0.0
- 8.0.0-beta10
- 8.0.0-beta11
- 8.0.0-beta12
- 8.0.0-beta13
- 8.0.0-beta14
- 8.0.0-beta15
- 8.0.0-beta16
- 8.0.0-beta6
- 8.0.0-beta7
- 8.0.0-beta8
- 8.0.0-beta9
- 8.0.0-rc1
- 8.0.0-rc2
- 8.0.0-rc3
- 8.0.0-rc4
- 8.0.1
- 8.0.2
- 8.0.3
- Affected ranges
- ECOSYSTEM: ≥ 8.0, < 8.0.4
Update to 8.0.4
drupal/drupal Packagist
- Versions
- 8.0.0
- 8.0.0-alpha14
- 8.0.0-alpha15
- 8.0.0-beta1
- 8.0.0-beta10
- 8.0.0-beta11
- 8.0.0-beta12
- 8.0.0-beta13
- 8.0.0-beta14
- 8.0.0-beta15
- 8.0.0-beta16
- 8.0.0-beta2
- 8.0.0-beta3
- 8.0.0-beta4
- 8.0.0-beta5
- 8.0.0-beta6
- 8.0.0-beta7
- 8.0.0-beta9
- 8.0.0-rc1
- 8.0.0-rc2
- 8.0.0-rc3
- 8.0.0-rc4
- 8.0.1
- 8.0.2
- 8.0.3
- Affected ranges
- ECOSYSTEM: ≥ 8.0, < 8.0.4
Update to 8.0.4
drupal/drupal Packagist
- Affected ranges
- ECOSYSTEM: ≥ 7.0, < 7.43
Update to 7.43
drupal7 Ubuntu:Pro:14.04:LTS
- Versions
- 7.23-1
- 7.24-1
- 7.24-2
- 7.26-1
- 7.26-1ubuntu0.1
- 7.26-1ubuntu0.1+esm1
- 7.26-1ubuntu0.1+esm2
- 7.26-1ubuntu0.1+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published