Vulnerability Description
The _prepopulate_request_walk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the (1) actions, (2) container, (3) token, (4) password, (5) password_confirm, (6) text_format, or (7) markup field type, and consequently have unspecified impact, via unspecified vectors.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Prepopulate Project | Prepopulate | 7.x-2.0 |
Related Weaknesses (CWE)
References
- http://cgit.drupalcode.org/prepopulate/commit/prepopulate.module?id=16cdb63cc3b2
- https://www.drupal.org/node/2679215Patch
- https://www.drupal.org/node/2679503PatchVendor Advisory
- http://cgit.drupalcode.org/prepopulate/commit/prepopulate.module?id=16cdb63cc3b2
- https://www.drupal.org/node/2679215Patch
- https://www.drupal.org/node/2679503PatchVendor Advisory
FAQ
What is CVE-2016-3188?
CVE-2016-3188 is a vulnerability with a CVSS score of 7.3 (HIGH). The _prepopulate_request_walk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the (1) actions, (2) container, (3) token, (4) password, (5) passwo...
How severe is CVE-2016-3188?
CVE-2016-3188 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-3188?
Check the references section above for vendor advisories and patch information. Affected products include: Prepopulate Project Prepopulate.