CVE-2015-2559

NameCVE-2015-2559
DescriptionDrupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-3200-1
Debian Bugs780772

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
drupal7 (PTS)jessie, jessie (lts)7.32-1+deb8u19fixed
stretch (security), stretch (lts), stretch7.52-2+deb9u18fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
drupal6sourcesqueeze(unfixed)end-of-life
drupal6source(unstable)(unfixed)
drupal7sourcewheezy7.14-2+deb7u9DSA-3200-1
drupal7source(unstable)7.32-1+deb8u2780772

Notes

https://www.drupal.org/SA-CORE-2015-001
http://cgit.drupalcode.org/drupal/commit/?id=8e54eca05a65c6231b02510e1917af0c9191e549

Search for package or bug name: Reporting problems