medium4.3
CVE-2016-7572
Drupal Unprivileged access to config export
Impact
The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | drupal/core | >= 8.0, < 8.1.10 | 8.1.10 |
| composer | drupal/drupal | >= 8.0, < 8.1.10 | 8.1.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Drupal | Drupal | Versions 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.securityfocus.com/bid/93101
- http://www.securitytracker.com/id/1036886
- https://www.drupal.org/SA-CORE-2016-004
- https://github.com/advisories/GHSA-fmqh-2j2x-vgp3
- https://nvd.nist.gov/vuln/detail/CVE-2016-7572
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7572.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7572.yaml