CVE-2016-7570

moderate-risk

Published 2016-10-03

Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.

Do I need to act?

0.34% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.3/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Drupal

Affected Vendors

Drupal

References (6)

Third Party Advisory http://www.securityfocus.com/bid/93101

Third Party Advisory http://www.securitytracker.com/id/1036886

Vendor Advisory https://www.drupal.org/SA-CORE-2016-004

Third Party Advisory http://www.securityfocus.com/bid/93101

Third Party Advisory http://www.securitytracker.com/id/1036886

Vendor Advisory https://www.drupal.org/SA-CORE-2016-004

/ 100

moderate-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 26/34 · High