Description
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 8.0, < 8.2.3 | 8.2.3 | GHSA-98w5-wqp9-w466 |
| Packagist | drupal/drupal | >= 8.0, < 8.2.3 | 8.2.3 | GHSA-98w5-wqp9-w466 |
References
- 94367 vdb-entry
- https://www.drupal.org/SA-CORE-2016-005