CVE-2016-3169

The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.

References

Affected packages

Git / github.com/drupal/drupal

Affected ranges

Type: GIT
Repo: https://github.com/drupal/drupal
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

01c9f6164e9b48a7d715e07fb0d98fbe71bae87b

Last affected

09bfa80c0c6ffabf7e02e706dbfd2f514619bbc4

Last affected

0c6f9b0074a227fe1b2fef3621925ef900039486

Last affected

10edcf72444e58b2032957edd3d478ac2d431b0c

Last affected

131a6f5129b18f3913ba5882111797f8588c5aaf

Last affected

154ffa85f8bf5033c958ba8face74797463a6bde

Last affected

1769d1cca92e206510528c324552797e83a1fc7c

Last affected

18c5da5028b7c3ba985e598bb8df45613285d437

Last affected

1d4604da252f0e6e19339957ec214388f61b908d

Last affected

1f124bf1accbad60b31a463ff59232d2f5626100

Last affected

203f323c8813f60c634ca23e025934d1527b0418

Last affected

237c0642a799ed3a1895f3144d8017422e2a8f72

Last affected

23bda276dc19dd3b3d17174b808020ae820879c7

Last affected

30d1e719aa5e9a9ad66514078ca3b0975ddadc9c

Last affected

316bd96ebff36284f5f3e33268760ff9c672b6f8

Last affected

3595e528c35eeeef5cdcd11932ede5af0b21447c

Last affected

39f366e0a91bb0f79cdf7aab8d50c92473e6bd4e

Last affected

3a24da1b40f5e05876ad7775044500b61eb2ed94

Last affected

40093b2fa7dde4a5f3c6806aad91b9302c232903

Last affected

497914920385b7016ac9c9367e0198530787adf2

Last affected

49e2d2ca6f6c6489b07b9e863150d20a38148a57

Last affected

49f719f7c4f7c1b69dc35ff8fbdea123e7d88f92

Last affected

4ba5f184c69306da0e30260890f01ea0694af274

Last affected

4d4080b17681ae674e10c077b72d00f0b1544e0c

Last affected

4e8e0454b3bfc3b846cf4b7bcaca0e8f42f0c17a

Last affected

5cb79b4b217e9aa315d61284398cce132c28bea4

Last affected

6642fbc7001c728e218170fd286e6b8a24eef24f

Last affected

66e94d74994fced9fafbb2583f1c9e1bc636c04f

Last affected

6b54665a5921d26d00559644754047420776da4a

Last affected

6f2fd0451a5cae837870da665f35514d8730fcf3

Last affected

77b6714fb3e0bcec9ef7df1a610eb6bdbf09636e

Last affected

782d1155c62c0a879bf587c7e40c3a13bcf6879c

Last affected

7c4e429b7fa771676a18321aac9896e86773891e

Last affected

7c757303a57f24770f2707529f8398d194a5efcd

Last affected

7e8649f761e0279e07b2050a7ec61097636f269b

Last affected

80cff5cedfe9f8a23596c1a7e1ae456c894a79ae

Last affected

8135c33f6fd219124b085a2e50ea9bf1f6e87612

Last affected

81586d9e9d04dcee487c50de426c04221899b6d0

Last affected

83b80acad8431fcd56e9a331ba06c41edee48c91

Last affected

84f629ace76044177ddd24ad03c2566b9af1688b

Last affected

85c9ed0b6a001b4196b24826841e2cf2d18d2612

Last affected

8636b1234c84a07f0f087ca5d64483c4fc7b2256

Last affected

87a469b868ad719c11fb59d932b8d4a5bcf02b08

Last affected

88146f6da7b169a6504ecfdd39fe29913c977350

Last affected

8ffc5db3c0ab926f3d4b2cf8bc51714c8c0f3c93

Last affected

90e884ad0f7f2cf269d953f7d70966de9fd821ff

Last affected

9260bc47d39971738f6d489554a4eb22c8c8e85e

Last affected

92eedf2c17bcea6db47c6b317c6ebf6078bfffae

Last affected

9879d29f731570a34b24c4eae4cc8cb30c7a5082

Last affected

9b9d9296c85e88d6ecb875d7e350e0083a105108

Last affected

9bf09eea76bbf071db4016252faca2d20bf1a6c2

Last affected

9ce67f2e403f7238a581fc78ca51a7f5ba32fb52

Last affected

9d16792580c241b42e6192b480f65cf0bdd07bc9

Last affected

9ee4a1a2fa3bedb3852d21f2198509c107c48890

Last affected

9f72251c9291b5613acb9ca4ea7a51b4739e3f93

Last affected

a07564a2968a464d3f800da0c2e75045caa367ea

Last affected

a09fcca0294ef62ba7b1c7ec2af2980f0a39d3e1

Last affected

a362d912056d6e385a6c458cddf776ec746c68ae

Last affected

a4fabec730e7377f6dfe656599145b40f778a77d

Last affected

a584af62514ba7ec37b82b0c7b17081fcca4c5e0

Last affected

a7c068b9bc213c599872a0f729d736f5ff3d7866

Last affected

b42286571f4a22324f321af025768107caa99c30

Last affected

b44056d2f8e8c71d35c85ec5c2fb8f7c8a02d8a8

Last affected

b47f95d3013619e33cafdf8b769b2b6179a07956

Last affected

b62ba500242b711ce932ecfeb258c00e22c258ba

Last affected

b9127101ffeca819e74a03fa9f5a48d026c562e5

Last affected

bdd3062d800919f27627b8fddc3887b2495074c2

Last affected

bf704d6ffe55d66a440a55a9d43e8846d46d2440

Last affected

c511a4abe771499fe4ff682decad59a3cd1e61d0

Last affected

c5d6e6334fb7a71ecf1dbc7e06a7de8ad9547b27

Last affected

c71b15f68010db028f07839c226d31563f220890

Last affected

ca9434462a4af269f24b0b616939938a3a4c112f

Last affected

d08387cf6316da3b5158ccc1063acc5399ef3ee2

Last affected

d0b330ef316d761fc02eadeb659f9ff1ab106c3e

Last affected

d516f6778e57da524e3491710c6e5a5382dc647e

Last affected

d6c7b4cf627ab409c595e1c76bf0a8deadbc7feb

Last affected

d8cfe088697631a9789895b4128b12ab79c07207

Last affected

da8023a98808d243a03d494750a30d06dd1827cc

Last affected

dc791ec5839b52c7616bf66993122aa9a1336384

Last affected

dce3c77a61d9510dbac6927b60a03bc8da19e947

Last affected

dff6422ef765e6a6b1ca03184e4ed334c895fd4c

Last affected

e9d0768c1326332a3f1bbac761e7d9d7156d4ae6

Last affected

eabb023933ac83947e5d238c4a83b1f5bdbcc738

Last affected

ead5598cdfaf1505b478aa03db4017f9c1f829f5

Last affected

ebf9026bb8411de4866824f45ab825ecb41a5f47

Last affected

ec59e1197a2aa37557f9a87f13ba4d90e6aabf4c

Last affected

effed1c831c997be26e12f18be0d8eb683f21a75

Last affected

f8d6bbf44160e6d00e71f0172ecf80e78d0f0d3c

Last affected

f9784cf829fe2d6aad57b6de1f2e3a167e95cea6

Last affected

fee422170acc602c2049af4dc2fd00f1da3c5713

Affected versions

1.*

1.0

2.*

2.0

3.*

3.0.1

5.*

5.0-beta-1

5.0-beta-2

5.0-rc-1

5.0-rc-2

6.*

6.0

6.0-beta-1

6.0-beta-2

6.0-beta-3

6.0-beta-4

6.0-rc-1

6.0-rc-2

6.0-rc-3

6.0-rc-4

6.1

6.10

6.11

6.12

6.13

6.14

6.15

6.16

6.17

6.19

6.2

6.20

6.21

6.22

6.23

6.24

6.25

6.26

6.27

6.28

6.29

6.3

6.30

6.31

6.32

6.33

6.34

6.4

6.5

6.6

6.7

6.8

6.9

7.*

7.0

7.0-alpha1

7.0-alpha2

7.0-alpha3

7.0-alpha4

7.0-alpha5

7.0-alpha6

7.0-alpha7

7.0-beta1

7.0-beta2

7.0-beta3

7.0-rc-1

7.0-rc-2

7.0-rc-3

7.0-rc-4

7.0-unstable-1

7.0-unstable-10

7.0-unstable-2

7.0-unstable-3

7.0-unstable-4

7.0-unstable-5

7.0-unstable-6

7.0-unstable-7

7.1

7.2

7.3

7.4

7.5

7.6

7.7

7.8

7.9

Other

start

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-3169.json"