Description

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.

Remediation

References

CVE-2014-9015

Related Vulnerabilities

WordPress Plugin Supafolio Multiple Unspecified Vulnerabilities (2.1.0)

MySQL CVE-2019-2798 Vulnerability (CVE-2019-2798)

TYPO3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2010-5103)

Oracle Application Server CVE-2009-0993 Vulnerability (CVE-2009-0993)

OpenVPN AS Improper Authentication Vulnerability (CVE-2020-15077)

Severity

Medium

Classification

CVE-2014-9015 CWE-264

Tags

Missing Update Known Vulnerabilities