CVE-2016-3168

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests…

published April 12, 2016

CVSS
—
EPSS
2%
Percentile
84.3
In the wild
Unconfirmed
What it is

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02472 · 84.3th percentile
Published
2016-04-12T15:00Z
EPSS history
Timeline
  • 12 APR 15:00Z
    The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests…
    cvelistv5