CVE-2016-3168

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x prior to 6.38 Drupal versions 7.x prior to 7.43

Description The issue might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content.

Recommendations For versions 6.x prior to 6.38, update to version 6.38 or later. For versions 7.x prior to 7.43, update to version 7.43 or later.