Description

Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.

Remediation

References

CVE-2015-2559

Related Vulnerabilities

Internet Information Services Other Vulnerability (CVE-2000-0970)

Ruby on Rails Other Vulnerability (CVE-2013-0333)

Nginx Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2018-16845)

Sqlite Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2008-6593)

WordPress Plugin Remove Schema Cross-Site Request Forgery (1.4)

Severity

Low

Tags

Missing Update Known Vulnerabilities CWE-284 CVE-2015-2559