Drupal Secure Password Hashes Reset Link Security Bypass Vulnerability
BID:48502
Info
Drupal Secure Password Hashes Reset Link Security Bypass Vulnerability
| Bugtraq ID: | 48502 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 29 2011 12:00AM |
| Updated: | Jun 29 2011 12:00AM |
| Credit: | PWolanin |
| Vulnerable: |
Drupal Secure Password Hashes 6.X-1.0 Drupal Secure Password Hashes 5.X-1.4 |
| Not Vulnerable: |
Drupal Secure Password Hashes 6.X-1.1 Drupal Secure Password Hashes 5.X-1.5 |
Discussion
Drupal Secure Password Hashes Reset Link Security Bypass Vulnerability
Secure Password Hashes for Drupal is prone to a security-bypass vulnerability.
An attacker can exploit this issue to reset the users password. Successful exploits will result in other attacks.
Secure Password Hashes for Drupal is prone to a security-bypass vulnerability.
An attacker can exploit this issue to reset the users password. Successful exploits will result in other attacks.
Exploit / POC
Drupal Secure Password Hashes Reset Link Security Bypass Vulnerability
An attacker can use readily available network utilities.
An attacker can use readily available network utilities.
Solution / Fix
Drupal Secure Password Hashes Reset Link Security Bypass Vulnerability
Solution:
The vendor released an update. Please see the references for details.
Solution:
The vendor released an update. Please see the references for details.
References
Drupal Secure Password Hashes Reset Link Security Bypass Vulnerability
References:
References: