Vulnerability advisory

GHSA-pqv4-xgqh-j8vh

Drupal sensitive information disclosure

Published May 17, 2022Updated Apr 23, 2024OSV record ↗

Also known as CVE-2016-3170

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected versions

drupal/core Packagist

All drupal/core advisories →

Affected	Fixed in
`7.0` to before 7.43	`7.43`Advisories →
`8.0` to before 8.0.4	`8.0.4`Advisories →
Also listed as affected (19) `8.0.0` `8.0.0-beta10` `8.0.0-beta11` `8.0.0-beta12` `8.0.0-beta13` `8.0.0-beta14` `8.0.0-beta15` `8.0.0-beta16` `8.0.0-beta6` `8.0.0-beta7` `8.0.0-beta8` `8.0.0-beta9` `8.0.0-rc1` `8.0.0-rc2` `8.0.0-rc3` `8.0.0-rc4` `8.0.1` `8.0.2` `8.0.3`

drupal/drupal Packagist

All drupal/drupal advisories →

Affected	Fixed in
`8.0` to before 8.0.4	`8.0.4`Advisories →
Also listed as affected (25) `8.0.0` `8.0.0-alpha14` `8.0.0-alpha15` `8.0.0-beta1` `8.0.0-beta10` `8.0.0-beta11` `8.0.0-beta12` `8.0.0-beta13` `8.0.0-beta14` `8.0.0-beta15` `8.0.0-beta16` `8.0.0-beta2` `8.0.0-beta3` `8.0.0-beta4` `8.0.0-beta5` `8.0.0-beta6` `8.0.0-beta7` `8.0.0-beta9` `8.0.0-rc1` `8.0.0-rc2` `8.0.0-rc3` `8.0.0-rc4` `8.0.1` `8.0.2` `8.0.3`
`7.0` to before 7.43	`7.43`Advisories →

Description

The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in.

GHSA-pqv4-xgqh-j8vh

Affected versions

drupal/core Packagist

drupal/drupal Packagist

Description

References