Unrated severityNVD Advisory· Published Mar 25, 2015· Updated Jun 17, 2026

CVE-2015-2559

Description

Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Drupal/Drupal2 versions
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*range: >=6.0,<6.35
- (no CPE)range: >=6.0 <6.35 || >=7.0 <7.35
Debian/linux
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

www.debian.org/security/2015/dsa-3200nvdThird Party Advisory
www.securityfocus.com/bid/73219nvdThird Party AdvisoryVDB Entry
www.drupal.org/SA-CORE-2015-001nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000