GHSA-98w5-wqp9-w466

Source

https://github.com/advisories/GHSA-98w5-wqp9-w466

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-98w5-wqp9-w466/GHSA-98w5-wqp9-w466.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-98w5-wqp9-w466

Aliases

CVE-2016-9450

Published

2022-05-17T03:38:33Z

Modified

2024-04-23T17:43:35.783558Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Drupal Incorrect cache context on password reset page

Details

The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.

Database specific

{
    "cwe_ids": [
        "CWE-345"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2016-11-25T18:59:00Z",
    "severity": "HIGH",
    "github_reviewed_at": "2024-04-23T17:21:07Z"
}

References

Affected packages

Packagist / drupal/core

Package

Name: drupal/core
Purl: pkg:composer/drupal/core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

8.0

Fixed

8.2.3

Affected versions

8.*

8.0.0-beta6

8.0.0-beta7

8.0.0-beta8

8.0.0-beta9

8.0.0-beta10

8.0.0-beta11

8.0.0-beta12

8.0.0-beta13

8.0.0-beta14

8.0.0-beta15

8.0.0-beta16

8.0.0-rc1

8.0.0-rc2

8.0.0-rc3

8.0.0-rc4

8.0.0

8.0.1

8.0.2

8.0.3

8.0.4

8.0.5

8.0.6

8.1.0-beta1

8.1.0-beta2

8.1.0-rc1

8.1.0

8.1.1

8.1.2

8.1.3

8.1.4

8.1.5

8.1.6

8.1.7

8.1.8

8.1.9

8.1.10

8.2.0-beta1

8.2.0-beta2

8.2.0-beta3

8.2.0-rc1

8.2.0-rc2

8.2.0

8.2.1

8.2.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-98w5-wqp9-w466/GHSA-98w5-wqp9-w466.json"

Packagist / drupal/drupal