Information disclosure in Drupal

CVE-2014-2983

Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors.

Vulnerability class: Information Disclosure

EPSS: 0.016 (72.8th percentile) — read the EPSS interpretation.

Affected products

Drupal
Debian Debian_linux — versions 6.0, 7.0, 8.0
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)