CVE-2015-2559

EPSS 0.45%
Veröffentlicht 25.03.2015 14:59:05
Zuletzt bearbeitet 12.04.2025 10:46:40
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 6

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Debian ≫ Debian Linux Version7.0

Drupal ≫ Drupal Version >= 6.0 < 6.35

Drupal ≫ Drupal Version >= 7.0 < 7.35

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.45%	0.63

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	3.5	6.8	2.9	AV:N/AC:M/Au:S/C:N/I:P/A:N

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

http://www.debian.org/security/2015/dsa-3200

Third Party Advisory

http://www.securityfocus.com/bid/73219

Third Party Advisory

VDB Entry

https://www.drupal.org/SA-CORE-2015-001

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2015-2559

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-2559

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-2559

EUVD