CVE-2017-8385

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.

• CWE-640

• https://craftcms.com/changelog#2-6-2976Release Notes, Vendor Advisory
• https://twitter.com/CraftCMS/status/857743080224473088Third Party Advisory
• https://craftcms.com/changelog#2-6-2976Release Notes, Vendor Advisory
• https://twitter.com/CraftCMS/status/857743080224473088Third Party Advisory

Published

May 1, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-8379Memory leak in the keyboard input event handlers support in …6.5
• CVE-2017-8380Buffer overflow in the "megasas_mmio_write" function in Qemu…
• CVE-2017-8381XnView Classic for Windows Version 2.40 allows user-assisted…
• CVE-2017-8382admidio 3.2.8 has CSRF in adm_program/modules/members/member…
• CVE-2017-8383Craft CMS before 2.6.2976 does not properly restrict viewing…
• CVE-2017-8384Craft CMS before 2.6.2976 allows XSS attacks because an arra…
• CVE-2017-8386git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x be…
• CVE-2017-8387STDU Viewer version 1.6.375 might allow user-assisted attack…
• CVE-2017-8388GeniXCMS 1.0.2 allows remote attackers to bypass the alertDa…
• CVE-2017-8390The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.…
• CVE-2017-8391The OS Installation Management component in CA Client Automa…
• CVE-2017-8392The Binary File Descriptor (BFD) library (aka libbfd), as di…