Denial of Service Vulnerability in Drupal Password Hashing API
CVE-2014-9016

Currently unrated

Key Information:

Vendor: Drupal
Status: Drupal; Secure Passwords Hashes
Vendor: CVE Published:; 24 November 2014

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 79%

What is CVE-2014-9016?

The password hashing API in Drupal versions prior to 7.34 and the Secure Password Hashes (phpass) module for versions 6.x-2.x before 6.x-2.1 are susceptible to a denial of service attack. Malicious actors can exploit this vulnerability by sending crafted requests that lead to excessive CPU and memory usage, potentially causing service disruptions. It is crucial for users to update to the respective patched versions to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

wp_drupal_timing_attack
Created by c0r3dump3d

WordPress-Long-Password-Denial-of-Service
Created by Primus27