Vulnerability advisory

CVE-2016-3170

Published Apr 12, 2016Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
497914920385b7016ac9c9367e0198530787adf2 through 3f7404935955cd2a63023e77a07c4231ad5ff62a	No fix listed
Also listed as affected (88) `7.0` `7.0-alpha1` `7.0-alpha2` `7.0-alpha3` `7.0-alpha4` `7.0-alpha5` `7.0-alpha6` `7.0-alpha7` `7.0-beta1` `7.0-beta2` `7.0-beta3` `7.1` `7.10` `7.11` `7.12` `7.13` `7.14` `7.15` `7.16` `7.17` `7.18` `7.19` `7.2` `7.20` `7.21` `7.22` `7.23` `7.24` `7.25` `7.26` `7.27` `7.28` `7.29` `7.3` `7.30` `7.33` `7.34` `7.35` `7.36` `7.37` `7.38` `7.39` `7.4` `7.40` `7.41` `7.42` `7.5` `7.6` `7.7` `7.8` `7.9` `8.0-alpha10` `8.0-alpha11` `8.0-alpha12` `8.0-alpha13` `8.0-alpha2` `8.0-alpha3` `8.0-alpha4` `8.0-alpha5` `8.0-alpha6` `8.0-alpha7` `8.0-alpha8` `8.0-alpha9` `8.0.1` `8.0.2` `8.0.3` `8.0.0` `8.0.0-rc4` `8.0.0-rc3` `8.0.0-rc2` `8.0.0-rc1` `8.0.0-beta16` `8.0.0-beta15` `8.0.0-beta14` `8.0.0-beta13` `8.0.0-beta12` `8.0.0-beta11` `8.0.0-beta10` `8.0.0-beta9` `8.0.0-beta7` `8.0.0-beta6` `8.0.0-beta5` `8.0.0-beta4` `8.0.0-beta3` `8.0.0-beta2` `8.0.0-beta1` `8.0.0-alpha15` `8.0.0-alpha14`

Description

The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in.

CVE-2016-3170

Affected versions

Repository

Description

References