Drupal Improper Access Control Vulnerability (CVE-2015-2559)

Description

Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.

Remediation

References

CVE-2015-2559

Related Vulnerabilities

WordPress Plugin Role Scoper Cross-Site Scripting (1.3.64)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-7846)

Oracle Database Server CVE-2015-4921 Vulnerability (CVE-2015-4921)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-2698)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-1647)

Severity

Low

Classification

CVE-2015-2559 CWE-284