CVE-2017-8385

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.

• https://craftcms.com/changelog#2-6-2976
  Release NotesVendor Advisory
• https://twitter.com/CraftCMS/status/857743080224473088
  Third Party Advisory
• https://craftcms.com/changelog#2-6-2976
  Release NotesVendor Advisory
• https://twitter.com/CraftCMS/status/857743080224473088
  Third Party Advisory