CVE-2016-7570

MEDIUM

Drupal 8.x < 8.1.10 - Authenticated Comment Visibility Manipulation

Title source: llm
STIX 2.1

Description

Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_confirm
https://www.drupal.org/SA-CORE-2016-004
Third Party Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/93101
Third Party Advisory vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1036886

Scores

CVSS v3 4.3
EPSS 0.0034
EPSS Percentile 57.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-264
Status published
Products (15)
drupal/core 8.0.0 - 8.1.10Packagist
drupal/drupal 8.0.0 (33 CPE variants)
drupal/drupal 8.0.1
drupal/drupal 8.0.2
drupal/drupal 8.0.3
drupal/drupal 8.0.4
drupal/drupal 8.0.5
drupal/drupal 8.0.6
drupal/drupal 8.1.0 (4 CPE variants)
drupal/drupal 8.1.1
... and 5 more
Published Oct 03, 2016
Tracked Since Feb 18, 2026