{"id":"CVE-2014-2983","aliases":["DEBIAN-CVE-2014-2983","DSA-2913-1","DSA-2914-1","EUVD-2014-3005","GHSA-p4jq-p7qf-pw64","MGASA-2014-0322","UBUNTU-CVE-2014-2983"],"status":"published","title":"Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different...","description":"Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01599,"percentile":0.7594,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2014-04-23T14:00:00Z","modified":"2026-06-17T00:07:26Z","fixes":[{"ecosystem":"Debian:7","package":"drupal7","fixed_in":["7.14-2+deb7u4"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"drupal6","fixed_in":["6.31-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14-2+deb7u4"}]}],"versions":["7.14-2","7.14-2+deb7u1","7.14-2+deb7u1~bpo60+1","7.14-2+deb7u2","7.14-2+deb7u2~bpo60+1","7.14-2+deb7u3","7.14-2+deb7u4~bpo60+1"]},{"source":"osv","ecosystem":"Debian:6.0","package":"drupal6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.31-1"}]}],"versions":["6.18-1","6.18-1squeeze1","6.20-1","6.20-1~bpo50+1","6.20-1~bpo60+1","6.20-2","6.22-1","6.22-1~bpo60+1","6.26-1","6.26-1.1","6.26-1~bpo60+1","6.28-1","6.29-1","6.30-1"]},{"source":"osv","ecosystem":"Mageia:3","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29-1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29-1.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1","7.26-1ubuntu0.1+esm2","7.26-1ubuntu0.1+esm3"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"drupal","product":"drupal"}],"references":[{"url":"http://www.debian.org/security/2014/dsa-2913","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory"]},{"url":"https://drupal.org/SA-CORE-2014-002","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","report"]},{"url":"http://www.debian.org/security/2014/dsa-2914","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/04/22/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2983"},{"url":"https://github.com/advisories/GHSA-p4jq-p7qf-pw64"},{"url":"https://advisories.mageia.org/MGASA-2014-0322.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13271","tags":["report"]},{"url":"https://drupal.org/SA-CORE-2014-003","tags":["web"]},{"url":"https://drupal.org/drupal-7.27","tags":["web"]},{"url":"https://drupal.org/drupal-7.27-release-notes","tags":["web"]},{"url":"https://drupal.org/drupal-7.28","tags":["web"]},{"url":"https://drupal.org/drupal-7.28-release-notes","tags":["web"]},{"url":"https://drupal.org/drupal-7.29","tags":["web"]},{"url":"https://drupal.org/drupal-7.29-release-notes","tags":["web"]},{"url":"https://www.debian.org/security/2014/dsa-2913","tags":["web"]},{"url":"https://www.debian.org/security/2014/dsa-2983","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-2983","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-2983","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-2983","description":"Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors.","status":"published","published":"2014-04-23T14:00:00Z","modified":"2024-08-06T10:28:46.382Z","updated_at":"2026-11-02T14:33:43.883586Z"}],"euvd":[{"id":"EUVD-2014-3005","description":"Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors.","status":"published","published":"2014-04-23T14:00:00Z","modified":"2024-08-06T10:28:46Z","updated_at":"2026-11-03T01:57:12.660671Z"}],"ghsa":[{"id":"GHSA-p4jq-p7qf-pw64","title":"Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different...","description":"Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors.","status":"published","published":"2022-05-13T01:10:45Z","modified":"2023-02-01T05:03:39Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:50:05.685198Z"}],"nvd":[{"id":"CVE-2014-2983","description":"Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors.","status":"published","published":"2014-04-23T15:55:05.89Z","modified":"2026-06-17T00:07:26.163Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"DSA-2913-1","title":"drupal7 - security update","status":"published","published":"2014-04-25T00:00:00Z","modified":"2026-03-09T01:18:03.513943Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"DSA-2914-1","title":"drupal6 - security update","status":"published","published":"2014-04-25T00:00:00Z","modified":"2026-03-09T01:19:40.795139Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0322","title":"Updated drupal packages fix security vulnerabilities","description":"An information disclosure vulnerability was discovered in Drupal before 7.27.\nWhen pages are cached for anonymous users, form state may leak between\nanonymous users. Sensitive or private information recorded for one anonymous\nuser could thus be disclosed to other users interacting with the same form at\nthe same time (CVE-2014-2983).\n\nMultiple security issues in Drupal before 7.29, including a denial of service\nissue, an access bypass issue in the File module, and multiple cross-site\nscripting issues (CVE-2014-5019, CVE-2014-5020, CVE-2014-5021, CVE-2014-5022).\n\nDrupal has been updated to version 7.29, fixing this and other bugs.\n","status":"published","published":"2014-08-07T17:01:33Z","modified":"2026-04-16T06:25:32.393736246Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2014-2983","description":"Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors.","status":"published","published":"2014-04-23T15:55:00Z","modified":"2025-09-08T16:43:09Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}