Your submission was sent successfully! Close

CVE-2016-3165

Published: 12 April 2016

The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "#access" set to FALSE in the server-side form definition.

Priority

Unknown

CVSS 3 base score: 7.5

Status

Package Release Status
drupal6
Launchpad, Ubuntu, Debian
precise Does not exist
(precise was needs-triage)
trusty Does not exist

upstream
Released (6.38)
wily Does not exist

xenial Does not exist

yakkety Does not exist

zesty Does not exist

drupal7
Launchpad, Ubuntu, Debian
precise Does not exist
(precise was not-affected)
trusty Does not exist
(trusty was not-affected)
upstream Not vulnerable

wily Not vulnerable

xenial Not vulnerable

yakkety Not vulnerable

zesty Not vulnerable