Vulnerability Details : CVE-2016-7570
Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.
Products affected by CVE-2016-7570
- cpe:2.3:a:drupal:drupal:8.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:beta6:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:beta12:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:beta10:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:beta7:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:alpha14:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:alpha7:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:alpha5:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:alpha4:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:beta16:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:beta15:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:beta14:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:beta13:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:alpha12:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:alpha11:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:alpha10:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:alpha9:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:beta11:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:beta9:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:alpha15:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:alpha13:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:alpha8:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.0:alpha6:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.1.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.1.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.1.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.1.6:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-7570
0.10%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 42 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-7570
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST | |
|
4.3
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
2.8
|
1.4
|
NIST |
CWE ids for CVE-2016-7570
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-7570
-
http://www.securitytracker.com/id/1036886
Drupal Bugs Let Remote Users Conduct Cross-Site Scripting Attacks and Remote Authenticated Users Download the Configuration File and Modify Certain Settings - SecurityTrackerThird Party Advisory
-
https://www.drupal.org/SA-CORE-2016-004
Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-004 | Drupal.orgVendor Advisory
-
http://www.securityfocus.com/bid/93101
Drupal Core Multiple Access Bypass and Cross Site Scripting VulnerabilitiesThird Party Advisory
Jump to