Date: Thu, 19 Mar 2015 23:45:49 +0100 From: Pere Orga <pere@...a.cat> To: oss-security@...ts.openwall.com Subject: CVE requests for Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001 Hi Please can I have CVEs assigned to the following vulnerabilities: Access bypass (Password reset URLs - Drupal 6 and 7) Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password. Open redirect (Several vectors including the "destination" URL parameter - Drupal 6 and 7) Under certain circumstances, malicious users can use the destination URL parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks. For more details see https://www.drupal.org/SA-CORE-2015-001 Regards Pere Orga on behalf of the Drupal Security Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ