Servers and applications
CVE-2014-2983
Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors.
- Severity
- Medium 5.0
- Published
- 23 Apr 2014
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 6.31, 7.27
- Exploit chance
- 1.6% in the next 30 daysHigher than 76% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- Information exposure (CWE-200)
- Attack
- Over the network · No login needed
- Attacker can
- Read some data
- CVSS vector
AV:N/AC:L/Au:N/C:P/I:N/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
DrupalServers and applications · cpe:a:drupal:drupal |
|