Vulnerability in Drupal

CVE-2015-2559

Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.

EPSS: 0.016 (73.9th percentile) — read the EPSS interpretation.

Affected products

Drupal
Debian Debian_linux — versions 7.0
N/a — versions n/a

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)