Description

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.

Remediation

References

CVE-2014-9015

Related Vulnerabilities

WordPress Plugin Google Analytics Dashboard SQL Injection (2.0.4)

WordPress Plugin Tutor LMS-eLearning and online course solution Security Bypass (2.6.2)

Python Cryptographic Issues Vulnerability (CVE-2012-1150)

JBoss Application Server Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-1094)

WordPress Plugin PushEngage Web Push Notifications Cross-Site Scripting (1.5.8)

Severity

Medium

Classification

CVE-2014-9015 CWE-264

Tags

Missing Update Known Vulnerabilities