Drupal up to 6.37 Form API access control

Summaryinfo

A vulnerability was found in Drupal up to 6.37 and classified as critical. Affected is an unknown function of the component Form API. Such manipulation leads to access control. This vulnerability is listed as CVE-2016-3165. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Drupal up to 6.37 (Content Management System). It has been rated as critical. Affected by this issue is an unknown code of the component Form API. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "#access" set to FALSE in the server-side form definition.

The weakness was presented 04/12/2016 (Website). The advisory is shared for download at openwall.com. This vulnerability is handled as CVE-2016-3165 since 03/14/2016. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 11580 (Drupal Core Multiple Security Vulnerabilities (SA-CORE-2016-001)).

Upgrading to version 6.38 eliminates this vulnerability.

See VDB-82265, VDB-82266, VDB-82267 and VDB-82269 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Drupal

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.11
• 6.12
• 6.13
• 6.14
• 6.15
• 6.16
• 6.17
• 6.18
• 6.19
• 6.20
• 6.21
• 6.22
• 6.23
• 6.24
• 6.25
• 6.26
• 6.27
• 6.28
• 6.29
• 6.30
• 6.31
• 6.32
• 6.33
• 6.34
• 6.35
• 6.36
• 6.37

License

• open-source

Website

• Product: https://www.drupal.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion