CVE-2015-2559
published 2015-03-25CVE-2015-2559: Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same…
PriorityP422low3.5CVSS 2.0
AVNACMAuSCNIPAN
EPSS
1.64%
74.0th percentile
Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| drupal | drupal | >= 6.0 < 6.35 | 6.35 |
| drupal | drupal | >= 7.0 < 7.35 | 7.35 |
CVSS provenance
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv3.5LOW
vendor_ubuntu3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hqq6-wqq7-jgjq: Drupal 6
ghsa_unreviewed·2022-05-14
CVE-2015-2559 [LOW] CWE-284 GHSA-hqq6-wqq7-jgjq: Drupal 6
Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.
OSV
drupal7 vulnerabilities
osv·2021-03-15·CVSS 3.5
CVE-2018-7600 [LOW] drupal7 vulnerabilities
drupal7 vulnerabilities
It was discovered that Drupal did not properly process certain input. An
attacker could use this vulnerability to execute arbitrary code or
completely compromise a Drupal site. (CVE-2018-7600, CVE-2018-7602)
It was discovered that password reset URLs in Drupal could be forged. An
attacker could use this vulnerability to gain access to another user's
account. This issue affected only Ubuntu 14.04 ESM. (CVE-2015-2559)
It was discovered that Drupal did not properly protect against open
redirects. An attacker could use this vulnerability to send unsuspecting
users to 3rd party sites and potentially carry out phishing attacks.
This issue affected only Ubuntu 14.04 ESM. (CVE-2015-2749, CVE-2015-2750)
OSV
CVE-2015-2559: Drupal 6
osv·2015-03-25·CVSS 3.5
CVE-2015-2559 [LOW] CVE-2015-2559: Drupal 6
Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.
Ubuntu
Drupal vulnerabilities
vendor_ubuntu·2021-03-15·CVSS 3.5
CVE-2018-7600 [LOW] Drupal vulnerabilities
Title: Drupal vulnerabilities
Summary: Several security issues were fixed in Drupal.
It was discovered that Drupal did not properly process certain input. An
attacker could use this vulnerability to execute arbitrary code or
completely compromise a Drupal site. (CVE-2018-7600, CVE-2018-7602)
It was discovered that password reset URLs in Drupal could be forged. An
attacker could use this vulnerability to gain access to another user's
account. This issue affected only Ubuntu 14.04 ESM. (CVE-2015-2559)
It was discovered that Drupal did not properly protect against open
redirects. An attacker could use this vulnerability to send unsuspecting
users to 3rd party sites and potentially carry out phishing attacks.
This issue affected only Ubuntu 14.04 ESM. (CVE-2015-2749, CVE-2015-2750)
Instru
No detection rules found.
No public exploits indexed.
2015-03-25
Published