Описание
Drupal Incorrect cache context on password reset page
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2016-9450
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9450.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9450.yaml
- https://www.drupal.org/SA-CORE-2016-005
- http://www.securityfocus.com/bid/94367
Пакеты
Наименование
drupal/core
composer
Затронутые версииВерсия исправления
>= 8.0, < 8.2.3
8.2.3
Наименование
drupal/drupal
composer
Затронутые версииВерсия исправления
>= 8.0, < 8.2.3
8.2.3
Связанные уязвимости
CVSS3: 7.5
ubuntu
почти 10 лет назад
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.
CVSS3: 7.5
nvd
почти 10 лет назад
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.
CVSS3: 7.5
debian
почти 10 лет назад
The user password reset form in Drupal 8.x before 8.2.3 allows remote ...