-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| drupal/core | composer | >= 6.0, < 6.38 | 6.38 |
| drupal/core | composer | >= 7.0, < 7.43 | 7.43 |
| drupal/drupal | composer | >= 7.0, < 7.43 | 7.43 |
| drupal/drupal | composer | >= 6.0, < 6.38 | 6.38 |
Miggo AIRoot Cause AnalysisThe vulnerability (CVE-2016-3168) involves reflected file downloads via the System module. Batch processing in Drupal uses system_batch_page() to handle batch operations, which returns JSON data. If this endpoint doesn't enforce proper Content-Type/Content-Disposition headers, browsers may treat the JSON response as a downloadable file. Attackers could manipulate parameters to control the content and filename, exploiting administrator sessions. The System module's batch handling is the logical location for this flaw, as confirmed by Drupal's security advisory linking the issue to improper response handling in batch operations.
Ongoing coverage of React2Shell