CVE requests for Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001

[Pere Orga <pere () orga cat>]

Hi

Please can I have CVEs assigned to the following vulnerabilities:

Access bypass (Password reset URLs - Drupal 6 and 7)
Password reset URLs can be forged under certain circumstances,
allowing an attacker to gain access to another user's account without
knowing the account's password.

Open redirect (Several vectors including the "destination" URL
parameter - Drupal 6 and 7)
Under certain circumstances, malicious users can use the destination
URL parameter to construct a URL that will trick users into being
redirected to a 3rd party website, thereby exposing the users to
potential social engineering attacks.


For more details see https://www.drupal.org/SA-CORE-2015-001

Regards
Pere Orga on behalf of the Drupal Security Team