CVE-2014-9016
NoneCVSS
—
EPSS
82.2%
Published
Nov 24, 2014
CISA due date
—
The record
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:7 | drupal7 | 0 | 7.14-2+deb7u8 |
| Mageia:3 | drupal | 0 | 7.34-1.mga3 |
| Mageia:4 | drupal | 0 | 7.34-1.mga4 |
| Ubuntu:Pro:14.04:LTS | drupal7 | 0 | No fix |
Related vulnerabilities
- CVE-2015-2559 Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the… Also affects drupal7
- CVE-2014-3704 The expandArguments function in the database abstraction API in Drupal core 7.x before… Also affects drupal7
- CVE-2014-5266 The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x… Also affects drupal7
- CVE-2024-55635 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site… Also affects drupal7
- CVE-2024-12393 Drupal Core Cross-Site Scripting (XSS) Also affects drupal7
- CVE-2024-55637 Drupal core contains a potential PHP Object Injection vulnerability Also affects drupal7
- CVE-2024-55634 Drupal core Access bypass Also affects drupal7
- CVE-2024-55636 Drupal core contains a potential PHP Object Injection vulnerability Also affects drupal7