1. CVE-Search
  2. CVE-2015-5505
ID CVE-2015-5505
Summary The HTTP Strict Transport Security (HSTS) module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the "include subdomains" directive, which causes the HSTS policy to not be applied to subdomains and allows man-in-the-middle attackers to have unspecified impact via unknown vectors.
References
Vulnerable Configurations
  • cpe:2.3:a:codfront_labs:http_strict_transport_security:6.x-1.0:*:*:*:*:drupal:*:*
    cpe:2.3:a:codfront_labs:http_strict_transport_security:6.x-1.0:*:*:*:*:drupal:*:*
  • cpe:2.3:a:codfront_labs:http_strict_transport_security:6.x-1.0:rc1:*:*:*:drupal:*:*
    cpe:2.3:a:codfront_labs:http_strict_transport_security:6.x-1.0:rc1:*:*:*:drupal:*:*
  • cpe:2.3:a:codfront_labs:http_strict_transport_security:6.x-1.x:dev:*:*:*:drupal:*:*
    cpe:2.3:a:codfront_labs:http_strict_transport_security:6.x-1.x:dev:*:*:*:drupal:*:*
  • cpe:2.3:a:codfront_labs:http_strict_transport_security:7.x-1.0:*:*:*:*:drupal:*:*
    cpe:2.3:a:codfront_labs:http_strict_transport_security:7.x-1.0:*:*:*:*:drupal:*:*
  • cpe:2.3:a:codfront_labs:http_strict_transport_security:7.x-1.0:rc1:*:*:*:drupal:*:*
    cpe:2.3:a:codfront_labs:http_strict_transport_security:7.x-1.0:rc1:*:*:*:drupal:*:*
  • cpe:2.3:a:codfront_labs:http_strict_transport_security:7.x-1.1:*:*:*:*:drupal:*:*
    cpe:2.3:a:codfront_labs:http_strict_transport_security:7.x-1.1:*:*:*:*:drupal:*:*
CVSS
Base: 6.8 (as of 26-07-2017 - 01:29)
Impact:
Exploitability:
CWE CWE-17
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
refmap via4
bid 75276
confirm
misc https://www.drupal.org/node/2507563
mlist [oss-security] 20150704 CVE requests for Drupal contributed modules (from SA-CONTRIB-2015-100 to SA-CONTRIB-2015-131)
sectrack 1037633
Last major update 26-07-2017 - 01:29
Published 18-08-2015 - 18:00
Last modified 26-07-2017 - 01:29
Back to Top