CVEvulnerability
CVE-2015-2559
3.5 LOW
Official page ↗
- Status
- Modified
- Published
- 2015-03-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-284
Description
Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.
Affected configurations
• debian debian linux 7.0
• drupal drupal (>= 6.0 < 6.35)
• drupal drupal (>= 7.0 < 7.35)
Related
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- http://www.debian.org/security/2015/dsa-3200 Third Party Advisory
- http://www.securityfocus.com/bid/73219 Third Party Advisory, VDB Entry
- https://www.drupal.org/SA-CORE-2015-001 Vendor Advisory
- http://www.debian.org/security/2015/dsa-3200 Third Party Advisory
- http://www.securityfocus.com/bid/73219 Third Party Advisory, VDB Entry
- https://www.drupal.org/SA-CORE-2015-001 Vendor Advisory