Drupal HTTP Strict Transport Security Module Security Bypass Vulnerability
BID:75276
Info
Drupal HTTP Strict Transport Security Module Security Bypass Vulnerability
| Bugtraq ID: | 75276 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-5505 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 17 2015 12:00AM |
| Updated: | Jan 23 2017 12:10AM |
| Credit: | Mark Burdett |
| Vulnerable: |
Oracle Enterprise Manager Ops Center 12.3.2 Oracle Enterprise Manager Ops Center 12.2.2 Oracle Enterprise Manager Ops Center 12.1.4 Drupal HTTP Strict Transport Security 7.x-1.1 Drupal HTTP Strict Transport Security 7.x-1.0 Drupal HTTP Strict Transport Security 6.x-1.0 |
| Not Vulnerable: |
Drupal HTTP Strict Transport Security 7.x-1.2 Drupal HTTP Strict Transport Security 6.X-1.1 |
Discussion
Drupal HTTP Strict Transport Security Module Security Bypass Vulnerability
Drupal HTTP Strict Transport Security module is prone to an authentication-bypass vulnerability.
Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks and bypass certain security restrictions.
The following versions are affected:
HTTP Strict Transport Security 7.x-1.x versions prior to 7.x-1.2
HTTP Strict Transport Security 6.x-1.x versions prior to 6.x-1.1
Drupal HTTP Strict Transport Security module is prone to an authentication-bypass vulnerability.
Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks and bypass certain security restrictions.
The following versions are affected:
HTTP Strict Transport Security 7.x-1.x versions prior to 7.x-1.2
HTTP Strict Transport Security 6.x-1.x versions prior to 6.x-1.1
Exploit / POC
Drupal HTTP Strict Transport Security Module Security Bypass Vulnerability
An attacker can use readily available tools to exploit this issue.
An attacker can use readily available tools to exploit this issue.