oss-security - CVE requests for Drupal Core - Moderately Critical - Multiple Vulnerabilities

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 19 Mar 2015 23:45:49 +0100
From: Pere Orga <pere@...a.cat>
To: oss-security@...ts.openwall.com
Subject: CVE requests for Drupal Core - Moderately Critical - Multiple
 Vulnerabilities - SA-CORE-2015-001

Hi

Please can I have CVEs assigned to the following vulnerabilities:

Access bypass (Password reset URLs - Drupal 6 and 7)
Password reset URLs can be forged under certain circumstances,
allowing an attacker to gain access to another user's account without
knowing the account's password.

Open redirect (Several vectors including the "destination" URL
parameter - Drupal 6 and 7)
Under certain circumstances, malicious users can use the destination
URL parameter to construct a URL that will trick users into being
redirected to a 3rd party website, thereby exposing the users to
potential social engineering attacks.

For more details see https://www.drupal.org/SA-CORE-2015-001

Regards
Pere Orga on behalf of the Drupal Security Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.