CVE-2016-3163 Drupal Brute force amplification attacks via XML-RPC
HighCVSS 7.5
EPSS 1.4%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal/core(Packagist) | >= 7.0, < 7.43 | 7.43 |
| drupal/core(Packagist) | >= 6.0, < 6.38 | 6.38 |
| drupal/drupal(Packagist) | >= 7.0, < 7.43 | 7.43 |
| drupal/drupal(Packagist) | >= 6.0, < 6.38 | 6.38 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| drupal/drupal | = 6.0 | No fix listed |
| drupal/drupal | = 6.0-beta1 | No fix listed |
| drupal/drupal | = 6.0-beta2 | No fix listed |
| drupal/drupal | = 6.0-beta3 | No fix listed |
| drupal/drupal | = 6.0-beta4 | No fix listed |
| drupal/drupal | = 6.0-dev | No fix listed |
| drupal/drupal | = 6.0-rc1 | No fix listed |
| drupal/drupal | = 6.0-rc2 | No fix listed |
| drupal/drupal | = 6.0-rc3 | No fix listed |
| drupal/drupal | = 6.0-rc4 | No fix listed |
| drupal/drupal | = 6.1 | No fix listed |
| drupal/drupal | = 6.2 | No fix listed |
| drupal/drupal | = 6.3 | No fix listed |
| drupal/drupal | = 6.4 | No fix listed |
| drupal/drupal | = 6.5 | No fix listed |
| drupal/drupal | = 6.6 | No fix listed |
| drupal/drupal | = 6.7 | No fix listed |
| drupal/drupal | = 6.8 | No fix listed |
| drupal/drupal | = 6.10 | No fix listed |
Show 85 more
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal/drupal | = 6.11 | No fix listed |
| drupal/drupal | = 6.12 | No fix listed |
| drupal/drupal | = 6.13 | No fix listed |
| drupal/drupal | = 6.14 | No fix listed |
| drupal/drupal | = 6.15 | No fix listed |
| drupal/drupal | = 6.16 | No fix listed |
| drupal/drupal | = 6.17 | No fix listed |
| drupal/drupal | = 6.18 | No fix listed |
| drupal/drupal | = 6.19 | No fix listed |
| drupal/drupal | = 6.20 | No fix listed |
| drupal/drupal | = 6.21 | No fix listed |
| drupal/drupal | = 6.22 | No fix listed |
| drupal/drupal | = 6.23 | No fix listed |
| drupal/drupal | = 6.24 | No fix listed |
| drupal/drupal | = 6.25 | No fix listed |
| drupal/drupal | = 6.26 | No fix listed |
| drupal/drupal | = 6.27 | No fix listed |
| drupal/drupal | = 6.28 | No fix listed |
| drupal/drupal | = 6.29 | No fix listed |
| drupal/drupal | = 6.30 | No fix listed |
| drupal/drupal | = 6.31 | No fix listed |
| drupal/drupal | = 6.32 | No fix listed |
| drupal/drupal | = 6.33 | No fix listed |
| drupal/drupal | = 6.34 | No fix listed |
| drupal/drupal | = 6.35 | No fix listed |
| drupal/drupal | = 6.36 | No fix listed |
| drupal/drupal | = 6.37 | No fix listed |
| drupal/drupal | = 7.0 | No fix listed |
| drupal/drupal | = 7.0-alpha1 | No fix listed |
| drupal/drupal | = 7.0-alpha2 | No fix listed |
| drupal/drupal | = 7.0-alpha3 | No fix listed |
| drupal/drupal | = 7.0-alpha4 | No fix listed |
| drupal/drupal | = 7.0-alpha5 | No fix listed |
| drupal/drupal | = 7.0-alpha6 | No fix listed |
| drupal/drupal | = 7.0-alpha7 | No fix listed |
| drupal/drupal | = 7.0-beta1 | No fix listed |
| drupal/drupal | = 7.0-beta2 | No fix listed |
| drupal/drupal | = 7.0-beta3 | No fix listed |
| drupal/drupal | = 7.0-dev | No fix listed |
| drupal/drupal | = 7.0-rc1 | No fix listed |
| drupal/drupal | = 7.0-rc2 | No fix listed |
| drupal/drupal | = 7.0-rc3 | No fix listed |
| drupal/drupal | = 7.0-rc4 | No fix listed |
| drupal/drupal | = 7.1 | No fix listed |
| drupal/drupal | = 7.2 | No fix listed |
| drupal/drupal | = 7.3 | No fix listed |
| drupal/drupal | = 7.4 | No fix listed |
| drupal/drupal | = 7.5 | No fix listed |
| drupal/drupal | = 7.6 | No fix listed |
| drupal/drupal | = 7.7 | No fix listed |
| drupal/drupal | = 7.8 | No fix listed |
| drupal/drupal | = 7.9 | No fix listed |
| drupal/drupal | = 7.10 | No fix listed |
| drupal/drupal | = 7.11 | No fix listed |
| drupal/drupal | = 7.12 | No fix listed |
| drupal/drupal | = 7.13 | No fix listed |
| drupal/drupal | = 7.14 | No fix listed |
| drupal/drupal | = 7.15 | No fix listed |
| drupal/drupal | = 7.16 | No fix listed |
| drupal/drupal | = 7.17 | No fix listed |
| drupal/drupal | = 7.18 | No fix listed |
| drupal/drupal | = 7.19 | No fix listed |
| drupal/drupal | = 7.20 | No fix listed |
| drupal/drupal | = 7.21 | No fix listed |
| drupal/drupal | = 7.22 | No fix listed |
| drupal/drupal | = 7.23 | No fix listed |
| drupal/drupal | = 7.24 | No fix listed |
| drupal/drupal | = 7.25 | No fix listed |
| drupal/drupal | = 7.26 | No fix listed |
| drupal/drupal | = 7.27 | No fix listed |
| drupal/drupal | = 7.28 | No fix listed |
| drupal/drupal | = 7.29 | No fix listed |
| drupal/drupal | = 7.30 | No fix listed |
| drupal/drupal | = 7.31 | No fix listed |
| drupal/drupal | = 7.32 | No fix listed |
| drupal/drupal | = 7.33 | No fix listed |
| drupal/drupal | = 7.34 | No fix listed |
| drupal/drupal | = 7.35 | No fix listed |
| drupal/drupal | = 7.36 | No fix listed |
| drupal/drupal | = 7.37 | No fix listed |
| drupal/drupal | = 7.38 | No fix listed |
| drupal/drupal | = 7.40 | No fix listed |
| drupal/drupal | = 7.41 | No fix listed |
| drupal/drupal | = 7.42 | No fix listed |
| drupal/drupal | = 7.x-dev | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit
- github.com exploit
- github.com product
- www.drupal.org patch vendor-advisory
- DSA-3498 vendor-advisory
- [oss-security] 20160224 CVE requests for Drupal core (SA-CORE-2016-001) mailing-list
- [oss-security] 20160315 Re: CVE requests for Drupal core (SA-CORE-2016-001) mailing-list
- github.com