{"id":"CVE-2014-9015","aliases":["DSA-3075-1","EUVD-2014-8843","GHSA-26gr-c7rc-wwqj","MGASA-2014-0492","UBUNTU-CVE-2014-9015"],"status":"published","title":"Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a...","description":"Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02458,"percentile":0.8454,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2014-11-20T00:00:00Z","modified":"2026-06-17T00:17:39Z","affected":[{"source":"osv","ecosystem":"Debian:7","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14-2+deb7u8"}]}],"versions":["7.14-2","7.14-2+deb7u1","7.14-2+deb7u1~bpo60+1","7.14-2+deb7u2","7.14-2+deb7u2~bpo60+1","7.14-2+deb7u3","7.14-2+deb7u4","7.14-2+deb7u4~bpo60+1","7.14-2+deb7u5","7.14-2+deb7u6","7.14-2+deb7u6~bpo60+1","7.14-2+deb7u7","7.14-2+deb7u7~bpo60+1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.34-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.34-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1","7.26-1ubuntu0.1+esm2","7.26-1ubuntu0.1+esm3"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"drupal","product":"drupal"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2014/11/20/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://www.drupal.org/SA-CORE-2014-006","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/11/20/21","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://secunia.com/advisories/59164","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://secunia.com/advisories/59814","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://www.debian.org/security/2014/dsa-3075","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9015"},{"url":"https://github.com/advisories/GHSA-26gr-c7rc-wwqj"},{"url":"https://advisories.mageia.org/MGASA-2014-0492.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14614","tags":["report"]},{"url":"https://drupal.org/drupal-7.33","tags":["web"]},{"url":"https://drupal.org/drupal-7.33-release-notes","tags":["web"]},{"url":"https://drupal.org/drupal-7.34","tags":["web"]},{"url":"https://drupal.org/drupal-7.34-release-notes","tags":["web"]},{"url":"https://www.debian.org/security/2014/dsa-3075","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-9015","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9015","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-9015","description":"Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.","status":"published","published":"2014-11-24T15:00:00Z","modified":"2024-08-06T13:33:13.543Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-8843","description":"Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.","status":"published","published":"2014-11-24T15:00:00Z","modified":"2024-08-06T13:33:13Z","updated_at":"2026-11-03T01:56:50.141542Z"}],"ghsa":[{"id":"GHSA-26gr-c7rc-wwqj","title":"Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a...","description":"Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.","status":"published","published":"2022-05-14T01:46:43Z","modified":"2023-02-02T05:04:28Z","updated_at":"2026-11-02T14:51:52.696148Z"}],"nvd":[{"id":"CVE-2014-9015","description":"Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.","status":"published","published":"2014-11-24T15:59:16.857Z","modified":"2026-06-17T00:17:39.407Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"DSA-3075-1","title":"drupal7 - security update","status":"published","published":"2014-11-20T00:00:00Z","modified":"2026-03-09T01:21:03.197006Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0492","title":"Updated drupal packages fix security vulnerabilities","description":"Updated drupal packages fix security vulnerability:\n\nAaron Averill discovered that a specially crafted request can give a user\naccess to another user's session, allowing an attacker to hijack a random\nsession (CVE-2014-9015).\n\nMichael Cullum, Javier Nieto and Andres Rojas Guerrero discovered that the\npassword hashing API allows an attacker to send specially crafted requests\nresulting in CPU and memory exhaustion. This may lead to the site becoming\nunavailable or unresponsive (denial of service) (CVE-2014-9016).\nanonymous users (CVE-2014-9016).\n","status":"published","published":"2014-11-26T17:29:06Z","modified":"2026-04-16T06:25:28.648268751Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2014-9015","description":"Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.","status":"published","published":"2014-11-24T15:59:00Z","modified":"2025-09-08T16:43:15Z","updated_at":"2026-11-02T15:54:09.378953Z"}]}}