CVE-2015-2559
low
CVSS v3
—
CVSS v2
3.5
VIR risk
3.5
Description
Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — https://www.drupal.org/SA-CORE-2015-001
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | 7.0 | affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| drupal | drupal | {"startIncluding":"6.0","endExcluding":"6.35"} | 6.35 |
References
CWEs
CWE-284
Verify integrity in audit chain (admin only). AS-IS.