Description
Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | drupal7 | 7.14-2+deb7u9 | DSA-3200-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | drupal7 | 7.44-1ubuntu1~16.04.0+esm1 | USN-4773-1 |
| Ubuntu Pro 14.04 LTS | drupal7 | 7.26-1ubuntu0.1+esm1 | USN-4773-1 |
Advisories 2
- USN-4773-1 drupal7 vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- DSA-3200-1 drupal7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-3200 vendor-advisory
- 73219 vdb-entry
- https://www.drupal.org/SA-CORE-2015-001