| Package | Affected versions | Patched versions |
|---|---|---|
| drupal | ≥ 6.0, < 6.35≥ 7.0, < 7.35 | 6.357.35 |
Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free