CVE-2015-5515: Medium severity views bulk operations vulnerability
The Views Bulk Operations (VBO) module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operation for changing Roles is enabled, allows remote authenticated users to edit user accounts and add arbitrary roles to the accounts by leveraging access to a user account listing view with VBO enabled.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5515?
CVE-2015-5515 has a moderate severity rating due to its potential impact on user account security.
How do I fix CVE-2015-5515?
To fix CVE-2015-5515, you should update the Views Bulk Operations module to version 7.x-3.3 or later.
Who is affected by CVE-2015-5515?
CVE-2015-5515 affects users of the Views Bulk Operations module for both Drupal 6 and 7 prior to the patched versions.
What type of attack is possible with CVE-2015-5515?
CVE-2015-5515 allows remote authenticated users to manipulate user roles and permissions improperly.
Is there a workaround for CVE-2015-5515?
Disabling the bulk operation feature for changing roles in Views Bulk Operations can serve as a temporary workaround for CVE-2015-5515.