CVE-2016-9450

The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2016-11-25

Last modified

2024-08-06

Weaknesses

CWE-345

Affected products

• Drupal (Drupal)

References

• http://www.securityfocus.com/bid/94367
• https://www.drupal.org/SA-CORE-2016-005