CVE-2015-2559 Auth bypass in n/a

Low 3.5 Published 25 Mar 2015 Updated 6 Aug 2024

Authenticated users can reset other users' passwords by exploiting identical password hashes and crafted reset URLs, leading to account takeover.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2015-2559?

CVE-2015-2559 is a low-severity authentication bypass vulnerability in Debian Debian Linux, published on 25 Mar 2015. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.

Weakness: CWE-284

Which versions are affected by CVE-2015-2559?

It affects 2 products.

Products include Debian Debian Linux, Drupal Drupal.

How do I fix CVE-2015-2559?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2015-2559 being exploited?

There is no known exploitation of CVE-2015-2559 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as GHSA-hqq6-wqq7-jgjq, UBUNTU-CVE-2015-2559.