Description

The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in.

Remediation

References

CVE-2016-3170

Related Vulnerabilities

WordPress Plugin Images Slideshow by 2J-Image Slider Unspecified Vulnerability (1.2.15)

Microsoft SQL Server Other Vulnerability (CVE-2002-0224)

WordPress Plugin BackupBuddy Information Disclosure (2.2.28)

MySQL CVE-2015-4807 Vulnerability (CVE-2015-4807)

Apache HTTP Server Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Vulnerability (CVE-2020-11984)

Severity

Medium

Classification

CVE-2016-3170 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities