CVE-2016-9450
Low
Low
Medium
High
Critical
CVSS Score
Vulnerability Description
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.
Known Affected Software
21 configuration(s) from 1 vendor(s)
drupal
Version:
8.2.2
CPE:
cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*
drupal
Version:
8.1.10
CPE:
cpe:2.3:a:drupal:drupal:8.1.10:*:*:*:*:*:*:*
drupal
Version:
8.0.0
CPE:
cpe:2.3:a:drupal:drupal:8.0.0:beta10:*:*:*:*:*:*
drupal
Version:
8.1.4
CPE:
cpe:2.3:a:drupal:drupal:8.1.4:*:*:*:*:*:*:*
drupal
Version:
8.1.2
CPE:
cpe:2.3:a:drupal:drupal:8.1.2:*:*:*:*:*:*:*
drupal
Version:
8.0.3
CPE:
cpe:2.3:a:drupal:drupal:8.0.3:*:*:*:*:*:*:*
drupal
Version:
8.0.2
CPE:
cpe:2.3:a:drupal:drupal:8.0.2:*:*:*:*:*:*:*
drupal
Version:
8.0.1
CPE:
cpe:2.3:a:drupal:drupal:8.0.1:*:*:*:*:*:*:*
drupal
Version:
8.1.3
CPE:
cpe:2.3:a:drupal:drupal:8.1.3:*:*:*:*:*:*:*
drupal
Version:
8.2.0
CPE:
cpe:2.3:a:drupal:drupal:8.2.0:-:*:*:*:*:*:*
drupal
Version:
8.1.7
CPE:
cpe:2.3:a:drupal:drupal:8.1.7:*:*:*:*:*:*:*
drupal
Version:
8.2.1
CPE:
cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*
drupal
Version:
8.1.5
CPE:
cpe:2.3:a:drupal:drupal:8.1.5:*:*:*:*:*:*:*
drupal
Version:
8.0.4
CPE:
cpe:2.3:a:drupal:drupal:8.0.4:*:*:*:*:*:*:*
drupal
Version:
8.1.0
CPE:
cpe:2.3:a:drupal:drupal:8.1.0:-:*:*:*:*:*:*
drupal
Version:
8.1.8
CPE:
cpe:2.3:a:drupal:drupal:8.1.8:*:*:*:*:*:*:*
drupal
Version:
8.0.5
CPE:
cpe:2.3:a:drupal:drupal:8.0.5:*:*:*:*:*:*:*
drupal
Version:
8.0.6
CPE:
cpe:2.3:a:drupal:drupal:8.0.6:*:*:*:*:*:*:*
drupal
Version:
8.1.9
CPE:
cpe:2.3:a:drupal:drupal:8.1.9:*:*:*:*:*:*:*
drupal
Version:
8.1.1
CPE:
cpe:2.3:a:drupal:drupal:8.1.1:*:*:*:*:*:*:*
drupal
Version:
8.1.6
CPE:
cpe:2.3:a:drupal:drupal:8.1.6:*:*:*:*:*:*:*
This vulnerability affects 21 software configuration(s). Ensure you patch all affected systems.
References & Resources
-
http://www.securityfocus.com/bid/94367cve@mitre.org Third Party Advisory VDB Entry
-
https://www.drupal.org/SA-CORE-2016-005cve@mitre.org Patch Vendor Advisory
-
http://www.securityfocus.com/bid/94367af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory VDB Entry
-
https://www.drupal.org/SA-CORE-2016-005af854a3a-2127-422b-91ae-364da2661108 Patch Vendor Advisory
Severity Details
out of 10.0
Low
Weakness Type (CWE)
CWE-345
Insufficient Verification of Data Authenticity
- Description
- The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
- Typical Severity
- Medium
- Abstraction Level
- Class
Key Information
- Published Date
- November 25, 2016
