CVE-2016-3165
CVE-2016-3165
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "#access" set to FALSE in the server-side form definition.
CVSS 7.5 · High · EPSS 1.4% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
drupal/core Packagist
- Affected ranges
- ECOSYSTEM: ≥ 6.0, < 6.38
Update to 6.38
drupal/drupal Packagist
- Affected ranges
- ECOSYSTEM: ≥ 6.0, < 6.38
Update to 6.38