Craft CMS 3.7.36 Password Reset Poisoning Attack
Posted by deepcore on May 7, 2022 – 5:01 am
Craft CMS version 3.7.36 suffers from a password reset poisoning vulnerability. An unauthenticated attacker who knows valid email addresses or account names of Craft CMS backend users is able to manipulate the password reset functionality in a way that the registered users of the CMS receive password reset emails containing a malicious password reset link.
Post a reply
You must be logged in to post a comment.