Medium severity5.3NVD Advisory· Published Apr 12, 2016· Updated May 6, 2026
CVE-2016-3170
CVE-2016-3170
Description
The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
drupal/corePackagist | >= 7.0, < 7.43 | 7.43 |
drupal/corePackagist | >= 8.0, < 8.0.4 | 8.0.4 |
drupal/drupalPackagist | >= 8.0, < 8.0.4 | 8.0.4 |
drupal/drupalPackagist | >= 7.0, < 7.43 | 7.43 |
Affected products
94cpe:2.3:a:drupal:drupal:7.7:*:*:*:*:*:*:*+ 91 more
- cpe:2.3:a:drupal:drupal:7.7:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.8:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.9:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:alpha6:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:alpha7:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:alpha8:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:alpha9:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:beta10:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:beta11:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:beta12:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:beta13:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:beta14:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:beta15:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:beta16:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:beta6:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:beta7:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:beta9:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:alpha4:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:alpha5:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:alpha6:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:alpha7:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:dev:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.2:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.3:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.4:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.5:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.6:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.10:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.11:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.12:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.13:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.14:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.15:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.16:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.17:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.18:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.19:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.20:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.21:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.22:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.23:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.24:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.25:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.26:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.27:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.28:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.29:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.30:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.33:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.34:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.35:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.36:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.37:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.38:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.39:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.40:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.41:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.42:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:7.x-dev:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:alpha10:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:alpha11:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:alpha12:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:alpha13:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:alpha14:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:alpha15:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:alpha4:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.0:alpha5:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
8- www.drupal.org/SA-CORE-2016-001nvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-pqv4-xgqh-j8vhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2016-3170ghsaADVISORY
- www.debian.org/security/2016/dsa-3498nvdWEB
- www.openwall.com/lists/oss-security/2016/02/24/19nvdWEB
- www.openwall.com/lists/oss-security/2016/03/15/10nvdWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3170.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3170.yamlghsaWEB
News mentions
0No linked articles in our index yet.