CVE-2015-5505

Published: Aug 18, 2015Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

The HTTP Strict Transport Security (HSTS) module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the "include subdomains" directive, which causes the HSTS policy to not be applied to subdomains and allows man-in-the-middle attackers to have unspecified impact via unknown vectors.

Affected (6)

Products: Codfront Labs: Http Strict Transport Security

Codfront Labs

1 product

Http Strict Transport Security

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Codfront Labs Http Strict Transport Security	Version 6.x-1.0
Codfront Labs Http Strict Transport Security	Version 6.x-1.0 rc1
Codfront Labs Http Strict Transport Security	Version 6.x-1.x dev
Codfront Labs Http Strict Transport Security	Version 7.x-1.0
Codfront Labs Http Strict Transport Security	Version 7.x-1.0 rc1
Codfront Labs Http Strict Transport Security	Version 7.x-1.1