CVE-2016-3168: Reflected file download vulnerability
Reflected file download vulnerability
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 6.38 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 7.43 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 7.43 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 6.38 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.0.4 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 8.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3168?
CVE-2016-3168 is considered a moderate severity vulnerability that could allow remote attackers to hijack site administrator authentication.
How do I fix CVE-2016-3168?
To mitigate CVE-2016-3168, upgrade to Drupal 6.38 or Drupal 7.43 or later.
What versions of Drupal are affected by CVE-2016-3168?
CVE-2016-3168 affects Drupal versions 6.x before 6.38 and 7.x before 7.43.
What is a reflected file download vulnerability like CVE-2016-3168?
A reflected file download vulnerability allows an attacker to trick victims into downloading a harmful file that may execute malicious content.
Who is impacted by CVE-2016-3168?
Administrators of Drupal sites using vulnerable versions are primarily impacted by CVE-2016-3168.