Описание
Drupal Incorrect cache context on password reset page
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2016-9450
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9450.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9450.yaml
- https://www.drupal.org/SA-CORE-2016-005
- http://www.securityfocus.com/bid/94367
Пакеты
Наименование
drupal/core
composer
Затронутые версииВерсия исправления
>= 8.0, < 8.2.3
8.2.3
Наименование
drupal/drupal
composer
Затронутые версииВерсия исправления
>= 8.0, < 8.2.3
8.2.3
Связанные уязвимости
CVSS3: 7.5
ubuntu
больше 8 лет назад
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.
CVSS3: 7.5
nvd
больше 8 лет назад
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.
CVSS3: 7.5
debian
больше 8 лет назад
The user password reset form in Drupal 8.x before 8.2.3 allows remote ...