CVE-2016-7570
Summary
| CVE | CVE-2016-7570 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2016-10-03 18:59:15 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes. |
Risk And Classification
Primary CVSS: v3.0 4.3 MEDIUM from [email protected]
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.003450000 probability, percentile 0.570500000 (date 2026-05-07)
Problem Types: CWE-264 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 4.3 | MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| 2.0 | [email protected] | Primary | 4 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
NoneAvailability
NoneCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
SingleConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:L/Au:S/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Drupal | Drupal | 8.0.0 | All | All | All |
| Application | Drupal | Drupal | 8.0.0 | alpha10 | All | All |
| Application | Drupal | Drupal | 8.0.0 | alpha11 | All | All |
| Application | Drupal | Drupal | 8.0.0 | alpha12 | All | All |
| Application | Drupal | Drupal | 8.0.0 | alpha13 | All | All |
| Application | Drupal | Drupal | 8.0.0 | alpha14 | All | All |
| Application | Drupal | Drupal | 8.0.0 | alpha15 | All | All |
| Application | Drupal | Drupal | 8.0.0 | alpha2 | All | All |
| Application | Drupal | Drupal | 8.0.0 | alpha3 | All | All |
| Application | Drupal | Drupal | 8.0.0 | alpha4 | All | All |
| Application | Drupal | Drupal | 8.0.0 | alpha5 | All | All |
| Application | Drupal | Drupal | 8.0.0 | alpha6 | All | All |
| Application | Drupal | Drupal | 8.0.0 | alpha7 | All | All |
| Application | Drupal | Drupal | 8.0.0 | alpha8 | All | All |
| Application | Drupal | Drupal | 8.0.0 | alpha9 | All | All |
| Application | Drupal | Drupal | 8.0.0 | beta1 | All | All |
| Application | Drupal | Drupal | 8.0.0 | beta10 | All | All |
| Application | Drupal | Drupal | 8.0.0 | beta11 | All | All |
| Application | Drupal | Drupal | 8.0.0 | beta12 | All | All |
| Application | Drupal | Drupal | 8.0.0 | beta13 | All | All |
| Application | Drupal | Drupal | 8.0.0 | beta14 | All | All |
| Application | Drupal | Drupal | 8.0.0 | beta15 | All | All |
| Application | Drupal | Drupal | 8.0.0 | beta16 | All | All |
| Application | Drupal | Drupal | 8.0.0 | beta2 | All | All |
| Application | Drupal | Drupal | 8.0.0 | beta3 | All | All |
| Application | Drupal | Drupal | 8.0.0 | beta4 | All | All |
| Application | Drupal | Drupal | 8.0.0 | beta6 | All | All |
| Application | Drupal | Drupal | 8.0.0 | beta7 | All | All |
| Application | Drupal | Drupal | 8.0.0 | beta9 | All | All |
| Application | Drupal | Drupal | 8.0.0 | rc1 | All | All |
| Application | Drupal | Drupal | 8.0.0 | rc2 | All | All |
| Application | Drupal | Drupal | 8.0.0 | rc3 | All | All |
| Application | Drupal | Drupal | 8.0.0 | rc4 | All | All |
| Application | Drupal | Drupal | 8.0.1 | All | All | All |
| Application | Drupal | Drupal | 8.0.2 | All | All | All |
| Application | Drupal | Drupal | 8.0.3 | All | All | All |
| Application | Drupal | Drupal | 8.0.4 | All | All | All |
| Application | Drupal | Drupal | 8.0.5 | All | All | All |
| Application | Drupal | Drupal | 8.0.6 | All | All | All |
| Application | Drupal | Drupal | 8.1.0 | All | All | All |
| Application | Drupal | Drupal | 8.1.0 | beta1 | All | All |
| Application | Drupal | Drupal | 8.1.0 | beta2 | All | All |
| Application | Drupal | Drupal | 8.1.0 | rc1 | All | All |
| Application | Drupal | Drupal | 8.1.1 | All | All | All |
| Application | Drupal | Drupal | 8.1.2 | All | All | All |
| Application | Drupal | Drupal | 8.1.3 | All | All | All |
| Application | Drupal | Drupal | 8.1.4 | All | All | All |
| Application | Drupal | Drupal | 8.1.5 | All | All | All |
| Application | Drupal | Drupal | 8.1.6 | All | All | All |
| Application | Drupal | Drupal | 8.1.7 | All | All | All |
| Application | Drupal | Drupal | 8.1.8 | All | All | All |
| Application | Drupal | Drupal | 8.1.9 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Drupal Core Multiple Access Bypass and Cross Site Scripting Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory |
| Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-004 | Drupal.org | af854a3a-2127-422b-91ae-364da2661108 | www.drupal.org | Vendor Advisory |
| Drupal Bugs Let Remote Users Conduct Cross-Site Scripting Attacks and Remote Authenticated Users Download the Configuration File and Modify Certain Settings - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.