PT-2015-6577 · Drupal · Hybridauth Social Login

Mike Goulding + 1 · Published 2015-06-15 · Updated 2016-06-09 · CVE-2015-4395

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions HybridAuth Social Login module versions 7.x-2.x before 7.x-2.10

Description The issue allows remote authenticated users with certain permissions to obtain sensitive information by leveraging access to the database, due to the storage of passwords in plaintext when the "Ask user for a password when registering" option is enabled.

Recommendations For HybridAuth Social Login module versions 7.x-2.x before 7.x-2.10, update to version 7.x-2.10 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-4395

Affected Products

Hybridauth Social Login

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-4395 · Security Note
• https://drupal.org/node/2475443 · Vendor Advisory
• https://drupal.org/node/2475943 · Vendor Advisory
• http://openwall.com/lists/oss-security/2015/04/25/6 · Note
• http://securityfocus.com/bid/74364 · Note