Description
The AES encryption module 7.x-1.4 for Drupal leaves certain debugging code enabled in release, which records the plaintext password of the last logged-in user and allows remote attackers to gain privileges as that user.
References
- aes-module-information-disclosure(65112) vdb-entry
- 70767 vdb-entry
- 43185 third-party-advisory
- http://drupal.org/node/1040728
- 46116 vdb-entry
- http://drupal.org/node/1048998