CVE-2016-3164

published 2016-04-12

CVE-2016-3164: Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or…

Priority P4 29 high 7.4 CVSS 3.0

AV N AC L PR N UI R S C C N I H A N

Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.

Affected

93 ranges · showing 25

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	debian_linux	—	—
drupal	core	>= 6.0 < 6.38	6.38
drupal	core	>= 7.0 < 7.43	7.43
drupal	core	>= 8.0 < 8.0.4	8.0.4
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—
drupal	drupal	—	—

CVSS provenance

nvd v3.0 7.4 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

nvd v2.0 5.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:N

osv 7.4 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.