CVE-2014-2983: Infoleak
Published Apr 23, 2014
·Updated
Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors.
Affected Software
5 affected components
Drupal Drupal>=6.0<6.31
Drupal Drupal>=7.0<7.27
Debian Debian Linux=6.0
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Remediation
Patch Available
Event History
Apr 23, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·03:55 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2983?
CVE-2014-2983 has been classified as a moderate severity vulnerability.
2
How do I fix CVE-2014-2983?
To fix CVE-2014-2983, you should upgrade Drupal to version 6.31 or 7.27 or later.
3
What are the implications of CVE-2014-2983?
CVE-2014-2983 allows remote anonymous users to access sensitive form input data intended for other users.
4
Which versions of Drupal are affected by CVE-2014-2983?
CVE-2014-2983 affects Drupal versions prior to 6.31 and 7.27.
5
Is CVE-2014-2983 relevant to Debian installations?
Yes, CVE-2014-2983 impacts Debian installations running affected versions of Drupal.