Impersonation in Drupal - CVE-2015-3234
Published: September 14, 2016
Vulnerability identifier: #VU431
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2015-3234
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Drupal
Affected software:
Drupal
Drupal
Detailed vulnerability description
The vulnerability allows attackers to hijack valid users' accounts.
The weakness is caused by malicious user's possibility to log in as another user (even administrator) on the site that may provide him access to data.
Successful exploitation of this vulnerability may result in hijacking of target users' accounts.
The weakness is caused by malicious user's possibility to log in as another user (even administrator) on the site that may provide him access to data.
Successful exploitation of this vulnerability may result in hijacking of target users' accounts.
How to mitigate CVE-2015-3234
Update 6.x to 6.36.
https://www.drupal.org/drupal-6.36-release-notes
Update 7.x to 7.38.
https://www.drupal.org/drupal-7.38-release-notes
https://www.drupal.org/drupal-6.36-release-notes
Update 7.x to 7.38.
https://www.drupal.org/drupal-7.38-release-notes