{"id":"GHSA-frqf-9qr4-6vxf","aliases":["CVE-2016-6211"],"title":"Drupal Saving user accounts can sometimes grant the user all roles","description":"The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.","severity":"high","score":8.8,"published":"2022-05-17T03:39:45.000Z","modified":"2024-04-23T17:43:52.588Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"drupal/core","ranges":[{"events":[{"introduced":"7.0"},{"fixed":"7.44"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["7.44"]},{"ecosystem":"Packagist","name":"drupal/drupal","ranges":[{"events":[{"introduced":"7.0"},{"fixed":"7.44"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["7.44"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2016-6211","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-6211.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-6211.yaml","https://github.com/drupal/core","https://www.drupal.org/SA-CORE-2016-002","http://www.debian.org/security/2016/dsa-3604","http://www.openwall.com/lists/oss-security/2016/07/13/4","http://www.openwall.com/lists/oss-security/2016/07/13/7","http://www.securityfocus.com/bid/91230"],"sources":[{"name":"OSV","id":"GHSA-frqf-9qr4-6vxf","modified":"2024-04-23T17:43:52.588231Z","url":"https://osv.dev/vulnerability/GHSA-frqf-9qr4-6vxf"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}]}