Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4773-1 advisory.

    It was discovered that Drupal did not properly process certain input. An attacker could use this     vulnerability to execute arbitrary code or completely compromise a Drupal site. (CVE-2018-7600,     CVE-2018-7602)

    It was discovered that password reset URLs in Drupal could be forged. An attacker could use this     vulnerability to gain access to another user's account. This issue affected only Ubuntu 14.04 ESM.
    (CVE-2015-2559)

    It was discovered that Drupal did not properly protect against open redirects. An attacker could use this     vulnerability to send unsuspecting users to 3rd party sites and potentially carry out phishing attacks.
    This issue affected only Ubuntu 14.04 ESM. (CVE-2015-2749, CVE-2015-2750)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote web server is hosting an outdated version of Drupal, a PHP-based open-source content management system. The version of Drupal installed on the remote server is 6.x prior to 6.35 or 7.x prior to 7.35, and is affected by the following vulnerabilities :

 - An access bypass vulnerability exists in which password reset URLs can be forged. This allows a remote attacker to gain access to another user's account. (CVE-2015-2559)
 - An open redirect vulnerability exists which allows a remote attacker to craft a URL using the 'destination' parameter in order to trick users into being redirected to third-party sites. Additionally, several URL related API functions can be tricked into passing external URLs. (CVE-2015-2749, CVE-2015-2750)

Updated drupal packages fix security vulnerabilities :

An information disclosure vulnerability was discovered in Drupal before 7.27. When pages are cached for anonymous users, form state may leak between anonymous users. Sensitive or private information recorded for one anonymous user could thus be disclosed to other users interacting with the same form at the same time (CVE-2014-2983).

Multiple security issues in Drupal before 7.29, including a denial of service issue, an access bypass issue in the File module, and multiple cross-site scripting issues (CVE-2014-5019, CVE-2014-5020, CVE-2014-5021, CVE-2014-5022).

A denial of service issue exists in Drupal before 7.31, due to XML entity expansion in a publicly accessible XML-RPC endpoint.

A SQL Injection issue exists in Drupal before 7.32 due to the way the Drupal core handles prepared statements. A malicious user can inject arbitrary SQL queries, and thereby completely control the Drupal site.
This vulnerability can be exploited by remote attackers without any kind of authentication required (CVE-2014-3704).

Aaron Averill discovered that a specially crafted request can give a user access to another user's session, allowing an attacker to hijack a random session (CVE-2014-9015).

Michael Cullum, Javier Nieto and Andres Rojas Guerrero discovered that the password hashing API allows an attacker to send specially crafted requests resulting in CPU and memory exhaustion. This may lead to the site becoming unavailable or unresponsive (denial of service) (CVE-2014-9016). anonymous users (CVE-2014-9016).

Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password (CVE-2015-2559).

Under certain circumstances, malicious users can construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks. In addition, several URL-related API functions in Drupal 6 and 7 can be tricked into passing through external URLs when not intending to, potentially leading to additional open redirect vulnerabilities (CVE-2015-2749, CVE-2015-2750).

The drupal package has been updated to version 7.35 to fix this issue and other bugs. See the upstream advisory and release notes for more details.

Multiple vulnerabilities have been found in the Drupal content management framework. More information can be found at

The remote web server is running a version of Drupal that is 6.x prior to 6.35 or 7.x prior to 7.35. It is, therefore, potentially affected by the following vulnerabilities :

  - An access bypass vulnerability exists in which password     reset URLs can be forged. This allows a remote attacker     to gain access to another user's account.
    (CVE-2015-2559)

  - An open redirect vulnerability exists which allows a     remote attacker to craft a URL using the 'destination'     parameter in order to trick users into being redirected     to third-party sites. Additionally, several URL related     API functions can be tricked into passing external URLs.
    (CVE-2015-2749, CVE-2015-2750)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
183539	Ubuntu 16.04 ESM : Drupal vulnerabilities (USN-4773-1)	Nessus	Ubuntu Local Security Checks	critical
9213	Drupal 6.x < 6.35 / 7.x < 7.35 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
82456	Mandriva Linux Security Advisory : drupal (MDVSA-2015:181)	Nessus	Mandriva Local Security Checks	high
81984	Debian DSA-3200-1 : drupal7 - security update	Nessus	Debian Local Security Checks	medium
81975	Drupal 6.x < 6.35 / 7.x < 7.35 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2015-2559

high

Tenable Plugins

critical

medium

high

medium

medium