VULNERABILITY INTELLIGENCE

CVE-2015-2559

CVSS score3.5 LOW

EPSS probability1.64%

CISA KEVNot currently listed

Published2015-03-25

Last modified2026-06-17

CVSS vectorAV:N/AC:M/Au:S/C:N/I:P/A:N

Description

Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.

Weakness classification

CWE-284: Improper Access Control

Primary references

cve@mitre.org — Third Party Advisory
cve@mitre.org — Third Party Advisory, VDB Entry
cve@mitre.org — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory