Impersonation in Drupal - CVE-2015-3234
Published: September 14, 2016
Vulnerability identifier: #VU431
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-3234
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows attackers to hijack valid users' accounts.
The weakness is caused by malicious user's possibility to log in as another user (even administrator) on the site that may provide him access to data.
Successful exploitation of this vulnerability may result in hijacking of target users' accounts.
The weakness is caused by malicious user's possibility to log in as another user (even administrator) on the site that may provide him access to data.
Successful exploitation of this vulnerability may result in hijacking of target users' accounts.
Affected software
Drupal
Debian Linux
Fedora
drupal7
Debian Linux
Fedora
drupal7
How to mitigate CVE-2015-3234
Update 6.x to 6.36.
https://www.drupal.org/drupal-6.36-release-notes
Update 7.x to 7.38.
https://www.drupal.org/drupal-7.38-release-notes
https://www.drupal.org/drupal-6.36-release-notes
Update 7.x to 7.38.
https://www.drupal.org/drupal-7.38-release-notes
drupal7 - addressed in versions 7.38-1.el5, 7.38-1.el6, 7.38-1.el7, 7.38-1.fc21, 7.38-1.fc22