CVE-2016-3165

The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions…

published April 12, 2016

CVSS
—
EPSS
1%
Percentile
71.3
In the wild
Unconfirmed
What it is

The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "#access" set to FALSE in the server-side form definition.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01360 · 71.3th percentile
Published
2016-04-12T15:00Z
EPSS history
Timeline
  • 12 APR 15:00Z
    The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions…
    cvelistv5