CVE-2016-7570

4.3MEDIUM

Key Information

Vendor: Drupal
Status: Drupal
Vendor: CVE Published:; 3 October 2016

Summary

Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.

CVSS V3.1

Score:

4.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Oct 3, 2016
Vulnerability Reserved.
Sep 9, 2016

Collectors

NVD DatabaseMitre Database