CVE-2014-9015

MEDIUM 6.8CVE-2014-9015 · Published 24/11/2014 · updated 17/06/2026

In short

CVE-2014-9015 is a MEDIUM (CVSS 6.8) vulnerability affecting drupal (drupal).
Chance of exploitation in the next 30 days (EPSS): 2.5%, higher than 84.4% of all vulnerabilities.
Fix: update to 6.34, 7.34 or later.

Package	Affected versions	Patched versions
drupal drupal	`≥ 6.0, < 6.34≥ 7.0, < 7.34`	`6.347.34`

Description

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.

References

secunia.com/advisories/59164 · Third Party Advisory
secunia.com/advisories/59814 · Third Party Advisory
debian.org/security/2014/dsa-3075 · Third Party Advisory
openwall.com/lists/oss-security/2014/11/20/21 · Mailing List
openwall.com/lists/oss-security/2014/11/20/3 · Mailing List
drupal.org/SA-CORE-2014-006 · Vendor Advisory

More vulnerabilities in drupal

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

drupal

≥ 6.0, < 6.34≥ 7.0, < 7.34

6.347.34

More vulnerabilities in drupal

See all →