CVE-2016-3163: Brute force amplification attacks via XML-RPC
Brute force amplification attacks via XML-RPC
Other sources
The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 6.38 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 7.43 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 6.38 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 7.43 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.0.4 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 8.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3163?
CVE-2016-3163 has been classified as a moderate severity vulnerability due to potential brute-force amplification attacks.
How do I fix CVE-2016-3163?
To fix CVE-2016-3163, update your Drupal installation to version 6.38 or 7.43 or later.
What systems are affected by CVE-2016-3163?
CVE-2016-3163 affects Drupal versions 6.x prior to 6.38 and 7.x prior to 7.43.
What type of attack does CVE-2016-3163 facilitate?
CVE-2016-3163 facilitates brute-force amplification attacks through excessive method calls in the XML-RPC system.
Is there a workaround for CVE-2016-3163?
Disabling XML-RPC or limiting access to it can serve as a temporary workaround for CVE-2016-3163.