CVE-2014-9015: Debian Linux

Medium severity, CVSS 6.8. EPSS: 2.5% chance of exploitation in the next 30 days.

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.

Affected products

• Debian Debian Linux: version 7.0 only
• Drupal Drupal: from 6.0, before 6.34 (fixed in 6.34); from 7.0, before 7.34 (fixed in 7.34)

Published 2014-11-24. Last modified 2026-06-17.