The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges     by leveraging contributed or custom code that calls the user_save function with an explicit category and     loads all roles into the array. (CVE-2016-3169)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Drupal running on the remote web server is 7.x prior to 7.43. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the File module that allows an attacker     to view, delete, or substitute a link to a file that has     not yet been submitted or processed by a form. An     authenticated, remote attacker can exploit this, via     continuous deletion of temporary files, to block all     file uploads to a site.

  - A flaw exists in the XML-RPC system due to a failure to     limit the number of simultaneous calls being made to the     same method. A remote attacker can exploit this to     facilitate brute-force attacks.

  - A cross-site redirection vulnerability exists due to     improper validation of unspecified input before     returning it to the user, which can allow the current     path to be filled-in with an external URL. A remote     attacker can exploit this, via a crafted link, to     redirect a user to a malicious web page of the     attacker's choosing that targets weaknesses in the     client-side software or is used for phishing attacks.

  - An unspecified reflected file download flaw exists that     allows an attacker to trick a user into downloading and     running a file with arbitrary JSON-encoded content.

  - A flaw exists, related to how the user_save() API is     utilized, due to assigning improper roles when saving     user accounts. An authenticated, remote attacker can     exploit this, via crafted data added to a form or array,     to gain elevated privileges.

  - An information disclosure vulnerability exists in the     'have you forgotten your password' due to displaying the     username when a valid email address is provided. A     remote attacker can exploit this to obtain the usernames     recognized by the system.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security vulnerabilities have been found in the Drupal content management framework. For additional information, please refer to the upstream advisory at

ID	Name	Product	Family	Severity
244891	Linux Distros Unpatched Vulnerability : CVE-2016-3169	Nessus	Misc.	high
89683	Drupal 7.x < 7.43 Multiple Vulnerabilities	Nessus	CGI abuses	medium
89004	Debian DSA-3498-1 : drupal7 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-3169

high

Tenable Plugins

high

medium

high