CVE-2014-9015

Published: Nov 24, 2014Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.

Affected (3)

Products: Drupal: Drupal · Debian: Debian Linux

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Drupal Drupal	From 6.0 to 6.34
Drupal Drupal	From 7.0 to 7.34

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0

Related CWEs

CWE-264

References (12)

http://secunia.com/advisories/59164

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/59814

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2014/dsa-3075

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2014/11/20/21

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2014/11/20/3

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://www.drupal.org/SA-CORE-2014-006

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/59164