CVE-2014-9015

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a...

6.8 MediumFix available

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.

Exploit likelihood

2.46%Up 1.1 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2014-9015
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-9015
Updated: 2026-11-02

EUVDEUVD-2014-8843 No score

Record: EUVD-2014-8843
Updated: 2026-11-03

GitHub AdvisoriesGHSA-26gr-c7rc-wwqj No score

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a...

Record: GHSA-26gr-c7rc-wwqj
Updated: 2026-11-02

OSVMGASA-2014-0492 No score

Updated drupal packages fix security vulnerabilities

Updated drupal packages fix security vulnerability:

Aaron Averill discovered that a specially crafted request can give a user access to another user's session, allowing an attacker to hijack a random session (CVE-2014-9015).

Michael Cullum, Javier Nieto and Andres Rojas Guerrero discovered that the password hashing API allows an attacker to send specially crafted requests resulting in CPU and memory exhaustion. This may lead to the site becoming unavailable or unresponsive (denial of service) (CVE-2014-9016). anonymous users (CVE-2014-9016).

Record: MGASA-2014-0492
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-9015 No score

Record: UBUNTU-CVE-2014-9015
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`drupal7` Debian:7	before 7.14-2+deb7u8, plus listed versions 7.14-27.14-2+deb7u17.14-2+deb7u1~bpo60+17.14-2+deb7u27.14-2+deb7u2~bpo60+1 Show 8 moreShow less 7.14-2+deb7u37.14-2+deb7u47.14-2+deb7u4~bpo60+17.14-2+deb7u57.14-2+deb7u67.14-2+deb7u6~bpo60+17.14-2+deb7u77.14-2+deb7u7~bpo60+1	7.14-2+deb7u8
`drupal` Mageia:3	before 7.34-1.mga3	7.34-1.mga3
`drupal` Mageia:4	before 7.34-1.mga4	7.34-1.mga4
`drupal7` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9015 is a medium vulnerability (CVSS 6.8) in Drupal, published November 20, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.46%, the 84th percentile. Fixed in drupal7 7.14-2+deb7u8.

References

Show 10 moreShow less