CVE-2014-8735

The Bad Behavior module 6.x-2.x before 6.x-2.2216 and 7.x-2.x before 7.x-2.2216 for Drupal logs usernames and passwords, which allows remote authenticated users with the "administer bad behavior" permission to obtain sensitive information by reading a log file.

Score

CVSS 2.0 4.0 Medium

Status

Modified - cve@mitre.org

Published

2014-11-12

Last modified

2024-09-17

Weaknesses

CWE-200

Affected products

• Bad Behavior (Bad Behavior Project)

References

• https://www.drupal.org/node/2360953
• https://www.drupal.org/node/2360955
• https://www.drupal.org/node/2361611