CVE-2016-6211

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-09-09 · updated 2026-06-17
Weakness: CWE-264

Description

The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.

Affected products

Debian Linux: 8.0
Drupal: 7.0, 7.0-alpha1, 7.0-alpha2, 7.0-alpha3, 7.0-alpha4, 7.0-alpha5 (+54)

References

http://www.debian.org/security/2016/dsa-3604
http://www.openwall.com/lists/oss-security/2016/07/13/4
http://www.openwall.com/lists/oss-security/2016/07/13/7
http://www.securityfocus.com/bid/91230
https://www.drupal.org/SA-CORE-2016-002
http://www.debian.org/security/2016/dsa-3604
http://www.openwall.com/lists/oss-security/2016/07/13/4
http://www.openwall.com/lists/oss-security/2016/07/13/7
http://www.securityfocus.com/bid/91230
https://www.drupal.org/SA-CORE-2016-002

Get alerted when CVE-2016-6211 or the next vulnerability affects your stack