SB2016091903 - Input format access bypass in Drupal Drupal
Published: September 19, 2016
Security Bulletin ID
SB2016091903
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Input format access bypass (CVE-ID: N/A)
The vulnerability allows a remote user to insert arbitrary HTML and script code into pages or even execute PHP code.The weakness exists due to administrator's changes of the comment's input format able to process modified user's signatures. If the new format allows too much, attackers can inject arbitrary HTML and script code or execute PHP code.
Successful exploitation of the vulnerability leads to arbitrary HTML and script code injection or PHP code execution.
Remediation
Install update from vendor's website.