Miggo Logo
Miggo Vulnerability Database
→
CVE-2016-6211

CVE-2016-6211: Drupal Saving user accounts can sometimes grant the user all roles

8.8

CVSS Score
3.0

Basic Information

CVE ID
CVE-2016-6211
GHSA ID
GHSA-frqf-9qr4-6vxf
EPSS Score
0.81713%
CWE
CWE-269
Published
5/17/2022
Updated
5/3/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
drupal/corecomposer>= 7.0, < 7.447.44
drupal/drupalcomposer>= 7.0, < 7.447.44

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability arises when a form rebuild (e.g., via drupal_rebuild_form) retains role selection fields in the user profile form despite lacking proper permission re-checks. The user_profile_form function is responsible for adding role fields conditionally. If a rebuild bypasses the 'administer permissions' check (e.g., due to stale $form_state data), attackers can submit role changes. The fix in Drupal 7.44 enforced permission checks during rebuilds, confirming this function's central role in the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** Us*r mo*ul* in *rup*l *.x ***or* *.** *llows r*mot* *ut**nti**t** us*rs to **in privil***s vi* v**tors involvin* *ontri*ut** or *ustom *o** t**t tri***rs * r**uil* o* t** us*r pro*il* *orm.

Reasoning

T** vuln*r**ility *ris*s w**n * *orm r**uil* (*.*., vi* *rup*l_r**uil*_*orm) r*t*ins rol* s*l**tion *i*l*s in t** us*r pro*il* *orm **spit* l**kin* prop*r p*rmission r*-****ks. T** us*r_pro*il*_*orm *un*tion is r*sponsi*l* *or ***in* rol* *i*l*s *on*