PT-2014-4203 · Drupal · Drupal

Published 2014-01-24 · Updated 2014-02-21 · CVE-2014-1475

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x before 6.30 Drupal versions 7.x before 7.26

Description The issue allows remote OpenID users to authenticate as other users.

Recommendations For Drupal 6.x, update to version 6.30 or later. For Drupal 7.x, update to version 7.26 or later.

Fix

Related Identifiers

CVE-2014-1475

DSA-2847-1

DSA-2851-1

MGASA-2014-0031

Affected Products

Drupal

References · 16

• http://debian.org/security/2014/dsa-2851 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1475 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-1475 · Vendor Advisory
• http://debian.org/security/2014/dsa-2847 · Vendor Advisory
• http://secunia.com/advisories/56260 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-1475 · Vendor Advisory
• https://drupal.org/SA-CORE-2014-001 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0031 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0031.html · Security Note
• https://cve.org/CVERecord?id=CVE-2014-1475 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2014:031 · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/01/16 · Note
• http://secunia.com/advisories/56601 · Note
• https://bugs.mageia.org/show_bug.cgi?id=12325 · Note
• http://securityfocus.com/bid/64973 · Note