CVE-2014-9361: Infoleak
The LoginToboggan module 7.x-1.x before 7.x-1.4 for Drupal does not properly unset the authorized user role for certain users, which allows remote attackers with the pre-authorized role to gain privileges and possibly obtain sensitive information by accessing a Page Not Found (404) page.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9361?
CVE-2014-9361 is considered a critical vulnerability that can lead to privilege escalation for pre-authorized users.
How do I fix CVE-2014-9361?
To fix CVE-2014-9361, upgrade the LoginToboggan module to version 7.x-1.4 or later.
Who is affected by CVE-2014-9361?
CVE-2014-9361 affects users with the pre-authorized role on versions 7.x-1.0 through 7.x-1.3 of the LoginToboggan module.
What can attackers do exploiting CVE-2014-9361?
Attackers exploiting CVE-2014-9361 can gain unauthorized privileges and access sensitive information by leveraging a Page Not Found (404) page.
Is CVE-2014-9361 specific to Drupal?
Yes, CVE-2014-9361 specifically affects the LoginToboggan module for Drupal versions prior to 7.x-1.4.