CVE-2015-4395

The HybridAuth Social Login module 7.x-2.x before 7.x-2.10 for Drupal stores passwords in plaintext when the "Ask user for a password when registering" option is enabled, which allows remote authenticated users with certain permissions to obtain sensitive information by leveraging access to the database.

Score

CVSS 2.0 3.5 Low

Status

Modified - cve@mitre.org

Published

2015-06-15

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• Hybridauth Social Login (Hybridauth Social Login Project)

References

• http://www.openwall.com/lists/oss-security/2015/04/25/6
• http://www.securityfocus.com/bid/74364
• https://www.drupal.org/node/2475443
• https://www.drupal.org/node/2475943