writeups.xyz / Drupal Insecure Default Leads To Password Reset Poisoning

Submitter : c2a

Date: 29 May 2021

Bounty : undisclosed

Vulnerabilities :

• Password Reset
• Host Header Injection

Programs :

• Drupal

Authors :

• Bogdan Tiron (@Bogdan___T)

Link :
https://www.fortbridge.co.uk/research/drupal-insecure-default-leads-to-password-reset-poisoning/