CVE-2015-5496 The pass2pdf module for Drupal does not restrict access to generated PDF files, which allows remote attackers to obtain user passwords via unspecified vectors.

MediumCVSS 5.0 EPSS 1.4%

Published: 2015-08-18 20:00
Updated: 2026-06-17 03:29
Exploit status: No public exploit known

Description

The pass2pdf module for Drupal does not restrict access to generated PDF files, which allows remote attackers to obtain user passwords via unspecified vectors.

Affected products

Product	Affected versions	Fixed in
pass2pdf project pass2pdf	All versions	No fix listed

References

[oss-security] 20150704 CVE requests for Drupal contributed modules (from SA-CONTRIB-2015-100 to SA-CONTRIB-2015-131) mailing-list
74755 vdb-entry
www.drupal.org patch vendor-advisory

CVSS v2.0

5.0 Medium

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: None
Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.38% (percentile 72.6)
CWE: CWE-264

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.