CVE-2016-9450: Incorrect cache context on password reset page
Incorrect cache context on password reset page
Other sources
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 8.2.3 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.2.3
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9450?
CVE-2016-9450 is rated as a moderate severity vulnerability due to its potential for cache poisoning attacks.
How do I fix CVE-2016-9450?
To fix CVE-2016-9450, update your Drupal installation to version 8.2.3 or later.
What versions of Drupal are affected by CVE-2016-9450?
CVE-2016-9450 affects Drupal versions 8.0.0 through 8.2.2.
What is the impact of exploiting CVE-2016-9450?
Exploitation of CVE-2016-9450 may allow an attacker to perform cache poisoning, potentially affecting the integrity of cached content.
Is there a workaround for CVE-2016-9450?
There is no official workaround for CVE-2016-9450; the recommended action is to update to the secured version.