Drupal : Security Vulnerabilities Published In 2016 (Bypass)
The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "#access" set to FALSE in the server-side form definition.
| Max Base Score | 7.5 |
| Published | 2016-04-12 |
| Updated | 2016-04-13 |
| EPSS | 0.46% |
The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files.
| Max Base Score | 8.1 |
| Published | 2016-04-12 |
| Updated | 2016-04-22 |
| EPSS | 0.18% |
2 vulnerabilities found