PT-2015-7720 · Drupal+1 · Url Login+2

Published 2015-11-06 · Updated 2015-11-09 · CVE-2015-8082

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal Login Disable module versions 6.x-1.x before 6.x-1.1 Drupal Login Disable module versions 7.x-1.x before 7.x-1.2

Description The issue allows remote attackers to bypass the logout protection mechanism by leveraging a contributed user authentication module. This can be demonstrated by the CAS and URL Login modules, which do not properly load the user logout function.

Recommendations For Drupal Login Disable module version 6.x-1.x, update to version 6.x-1.1 or later. For Drupal Login Disable module version 7.x-1.x, update to version 7.x-1.2 or later.

Fix

Weakness Enumeration

CWE-17

Related Identifiers

CVE-2015-8082

Affected Products

Cas

Drupal Login Disable

Url Login

References · 6

• https://drupal.org/node/2571567 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-8082 · Security Note
• https://drupal.org/node/2608356 · Vendor Advisory
• https://drupal.org/node/2587641 · Patch
• https://drupal.org/node/2587643 · Note
• https://drupal.org/node/2303503 · Note