Description
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | craftcms/cms | < 2.6.2976 | 2.6.2976 | GHSA-j27g-r58q-624w |
Medium · 5.3
CVE-2017-8385
EUVD-2022-4254GHSA-j27g-r58q-624w
Craft CMS subject to URL forgery
Published May 1, 2017 · Updated Aug 5, 2024 · Assigned by mitre