CVE-2016-7572

MEDIUM

Drupal 8.x < 8.1.10 - Authenticated Configuration Export Access Bypass

Title source: llm
STIX 2.1

Description

The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_confirm
https://www.drupal.org/SA-CORE-2016-004
Third Party Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/93101
Third Party Advisory vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1036886

Scores

CVSS v3 4.3
EPSS 0.0025
EPSS Percentile 48.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-264
Status published
Products (15)
drupal/core 8.0 - 8.1.10Packagist
drupal/drupal 8.0.0 (33 CPE variants)
drupal/drupal 8.0.1
drupal/drupal 8.0.2
drupal/drupal 8.0.3
drupal/drupal 8.0.4
drupal/drupal 8.0.5
drupal/drupal 8.0.6
drupal/drupal 8.1.0 (4 CPE variants)
drupal/drupal 8.1.1
... and 5 more
Published Oct 03, 2016
Tracked Since Feb 18, 2026