CVE-2014-1475
The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to...
The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.
- Record
CVE-2014-1475- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.
- Record
CVE-2014-1475- Updated
- 2026-11-02
EUVDEUVD-2014-1551 No score
The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.
- Record
EUVD-2014-1551- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jf54-qfqg-9hgv No score
The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to...
The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.
- Record
GHSA-jf54-qfqg-9hgv- Updated
- 2026-11-02
OSVMGASA-2014-0031 No score
Updated drupal package fixes security vulnerabilities
Christian Mainka and Vladislav Mladenov reported a vulnerability in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their accounts (CVE-2014-1475).
Matt Vance and Damien Tournoud reported an access bypass vulnerability in the taxonomy module. Under certain circumstances, unpublished content can appear on listing pages provided by the taxonomy module and will be visible to users who should not have permission to see it (CVE-2014-1476).
- Record
MGASA-2014-0031- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-1475 No score
The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.
- Record
UBUNTU-CVE-2014-1475- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal7Debian:7 From an advisory covering 2 CVEs |
before 7.14-2+deb7u2, plus listed versions 7.14-27.14-2+deb7u17.14-2+deb7u1~bpo60+17.14-2+deb7u2~bpo60+1 |
7.14-2+deb7u2 |
drupal6Debian:6.0 |
before 6.30-1, plus listed versions 6.18-16.18-1squeeze16.20-16.20-1~bpo50+16.20-1~bpo60+1 Show 8 moreShow less6.20-26.22-16.22-1~bpo60+16.26-16.26-1.16.26-1~bpo60+16.28-16.29-1 |
6.30-1 |
drupalMageia:3 From an advisory covering 2 CVEs |
before 7.26-1.mga3 | 7.26-1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-1475 is a high vulnerability (CVSS 7.5) in Drupal, published January 20, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.53%, the 74th percentile. Fixed in drupal6 6.30-1.
References
debian.org/security/2014/dsa-2847
secunia.com/advisories/56601
securityfocus.com/bid/64973
drupal.org/SA-CORE-2014-001
mandriva.com/security/advisories?name=MDVSA-2014:031
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-1475
github.com/advisories/GHSA-jf54-qfqg-9hgv
advisories.mageia.org/MGASA-2014-0031.html
bugs.mageia.org/show_bug.cgi?id=12325
ubuntu.com/security/CVE-2014-1475
openwall.com/lists/oss-security/2014/01/16
cve.org/CVERecord?id=CVE-2014-1475