Drupal CVE-2016-9450

HIGH

Insufficient Verification of Data Authenticity (CWE-345)

2016-11-25 cve@mitre.org

Information Disclosure Drupal

7.5

CVSS 3.0 · NVD

Share

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

1

CVE Published

Nov 25, 2016 - 18:59 cve.org

HIGH 7.5

DescriptionCVE.org

The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.

AnalysisAI

The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-345. The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context. Affected products include: Drupal. Version information: before 8.2.3.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Drupal

View all

CVE-2018-7602 CRITICAL Act Now POC

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (

CVE-2014-3704 HIGH Act Now POC

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct

CVE-2016-5385 HIGH Act Now POC

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect

CVE-2014-9016 MEDIUM This Month POC

The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x

CVE-2026-9082 CRITICAL Act Now POC

SQL injection in Drupal core (versions 8.9.0 through the fixed 10.4.10/10.5.10/10.6.9 and 11.x branches through 11.3.10)

CVE-2014-5266 MEDIUM This Month POC

The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, doe

CVE-2012-4554 MEDIUM This Month POC

The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE d

CVE-2021-41182 MEDIUM This Month POC

jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel

CVE-2018-7600 CRITICAL Act Now POC

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

CVE-2019-6340 HIGH Act Now POC

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x befo

CVE-2021-41184 MEDIUM This Month

jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel

CVE-2020-28949 HIGH Act Now POC

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper

Same weakness CWE-345 – Insufficient Verification of Data Authenticity

View all

CVE-2023-38831 HIGH POC

CVE-2016-4553 HIGH

CVE-2016-4554 HIGH

CVE-2014-4936 CRITICAL POC

CVE-2025-66255 CRITICAL POC

CVE-2025-1945 CRITICAL POC

CVE-2024-11666 CRITICAL POC

CVE-2024-1554 CRITICAL POC

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

CVE-2021-34523 CRITICAL POC

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

Share

CVE-2016-9450 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy