PT-2014-8786 · Drupal · Drupal

Salvatore Bonaccorso · Published 2014-11-24 · Updated 2018-12-20 · CVE-2014-9015

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x through 6.33 Drupal versions 7.x through 7.33

Description The issue allows remote attackers to hijack sessions via a crafted request. This can be demonstrated by sending a crafted request to a server that supports both HTTP and HTTPS sessions.

Recommendations For Drupal versions 6.x through 6.33, update to version 6.34 or later. For Drupal versions 7.x through 7.33, update to version 7.34 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-9015

DSA-3075-1

MGASA-2014-0492

Affected Products

Drupal

References · 19

• https://debian.org/security/2014/dsa-3075 · Vendor Advisory
• https://drupal.org/SA-CORE-2014-006 · Vendor Advisory
• http://debian.org/security/2014/dsa-3075 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9015 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-9015 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-9015 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0492 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0492.html · Security Note
• https://drupal.org/drupal-7.33-release-notes · Note
• http://openwall.com/lists/oss-security/2014/11/20/21 · Note
• http://secunia.com/advisories/59164 · Note
• http://secunia.com/advisories/59814 · Note
• https://drupal.org/drupal-7.34 · Note
• https://bugs.mageia.org/show_bug.cgi?id=14614 · Note