{"id":"CVE-2014-1475","aliases":["DEBIAN-CVE-2014-1475","DSA-2847-1","DSA-2851-1","EUVD-2014-1551","GHSA-jf54-qfqg-9hgv","MGASA-2014-0031","UBUNTU-CVE-2014-1475"],"status":"published","title":"The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to...","description":"The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01526,"percentile":0.7486,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2014-01-20T00:00:00Z","modified":"2026-06-17T00:04:56Z","fixes":[{"ecosystem":"Debian:6.0","package":"drupal6","fixed_in":["6.30-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14-2+deb7u2"}]}],"versions":["7.14-2","7.14-2+deb7u1","7.14-2+deb7u1~bpo60+1","7.14-2+deb7u2~bpo60+1"],"bundled":2},{"source":"osv","ecosystem":"Debian:6.0","package":"drupal6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.30-1"}]}],"versions":["6.18-1","6.18-1squeeze1","6.20-1","6.20-1~bpo50+1","6.20-1~bpo60+1","6.20-2","6.22-1","6.22-1~bpo60+1","6.26-1","6.26-1.1","6.26-1~bpo60+1","6.28-1","6.29-1"]},{"source":"osv","ecosystem":"Mageia:3","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.26-1.mga3"}]}],"bundled":2}],"products":[{"vendor":"drupal","product":"drupal"}],"references":[{"url":"http://www.debian.org/security/2014/dsa-2847","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"http://secunia.com/advisories/56601","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.securityfocus.com/bid/64973","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://drupal.org/SA-CORE-2014-001","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","report"]},{"url":"http://secunia.com/advisories/56260","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:031","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://www.debian.org/security/2014/dsa-2851","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1475"},{"url":"https://github.com/advisories/GHSA-jf54-qfqg-9hgv"},{"url":"https://advisories.mageia.org/MGASA-2014-0031.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-1475","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/01/16","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1475","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-1475","description":"The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.","status":"published","published":"2014-01-24T18:00:00Z","modified":"2024-08-06T09:42:35.38Z","updated_at":"2026-11-02T14:33:46.310517Z"}],"euvd":[{"id":"EUVD-2014-1551","description":"The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.","status":"published","published":"2014-01-24T18:00:00Z","modified":"2024-08-06T09:42:35Z","updated_at":"2026-11-03T01:57:18.349202Z"}],"ghsa":[{"id":"GHSA-jf54-qfqg-9hgv","title":"The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to...","description":"The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.","status":"published","published":"2022-05-17T04:52:25Z","modified":"2023-01-28T05:02:40Z","updated_at":"2026-11-02T14:43:49.260703Z"}],"nvd":[{"id":"CVE-2014-1475","description":"The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.","status":"published","published":"2014-01-24T18:55:05.057Z","modified":"2026-06-17T00:04:56.463Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"DSA-2847-1","title":"drupal7 - several","status":"published","published":"2014-01-20T00:00:00Z","modified":"2026-03-09T01:18:26.055372Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"DSA-2851-1","title":"drupal6 - impersonation","status":"published","published":"2014-02-02T00:00:00Z","modified":"2026-03-09T01:19:25.133071Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0031","title":"Updated drupal package fixes security vulnerabilities","description":"Christian Mainka and Vladislav Mladenov reported a vulnerability in the\nOpenID module that allows a malicious user to log in as other users on the\nsite, including administrators, and hijack their accounts (CVE-2014-1475).\n\nMatt Vance and Damien Tournoud reported an access bypass vulnerability in\nthe taxonomy module. Under certain circumstances, unpublished content can\nappear on listing pages provided by the taxonomy module and will be\nvisible to users who should not have permission to see it (CVE-2014-1476).\n","status":"published","published":"2014-01-31T16:43:58Z","modified":"2026-04-16T06:26:13.663020773Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2014-1475","description":"The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.","status":"withdrawn","published":"2014-01-24T18:55:00Z","modified":"2025-07-16T07:31:44.535077Z","updated_at":"2026-11-02T15:54:07.855521Z"}]}}