CVE-2015-2559: Low severity debian linux vulnerability
Published Mar 25, 2015
·Updated
Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.
Affected Software
3 affected components
Debian Debian Linux=7.0
Drupal Drupal>=6.0<6.35
Drupal Drupal>=7.0<7.35
Event History
Mar 25, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-2559?
CVE-2015-2559 has a moderate severity rating allowing authenticated users to reset passwords of other accounts.
2
How do I fix CVE-2015-2559?
To fix CVE-2015-2559, upgrade Drupal to version 6.35 or 7.35 or later.
3
Who is affected by CVE-2015-2559?
CVE-2015-2559 affects Drupal versions prior to 6.35 and 7.35, including specific configurations in Debian Linux.
4
What kind of attack does CVE-2015-2559 enable?
CVE-2015-2559 enables remote authenticated users to reset passwords of other user accounts through crafted URLs.
5
Is there a workaround for CVE-2015-2559?
No specific workaround is provided for CVE-2015-2559; updating to a patched version is recommended.