| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/core | ≥ 8.0, < 8.2.3 | 8.2.3 |
| drupal/drupal | ≥ 8.0, < 8.2.3 | 8.2.3 |
| drupal | = 8.0.0= 8.0.1= 8.0.2= 8.0.3= 8.0.4= 8.0.5= 8.0.6= 8.1.0= 8.1.1= 8.1.10= 8.1.2= 8.1.3= 8.1.4= 8.1.5= 8.1.6= 8.1.7= 8.1.8= 8.1.9= 8.2.0= 8.2.1= 8.2.2 |
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free