PT-2015-6577

CVE-2015-4395

Published

2015-06-15

Updated

2016-06-09

Description by

CVSS 2.0

3.5

Low

MetricsAV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions HybridAuth Social Login module versions 7.x-2.x before 7.x-2.10

Description The issue allows remote authenticated users with certain permissions to obtain sensitive information by leveraging access to the database, due to the storage of passwords in plaintext when the "Ask user for a password when registering" option is enabled.

Recommendations For HybridAuth Social Login module versions 7.x-2.x before 7.x-2.10, update to version 7.x-2.10 or later to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Mike Goulding

Owen Kelly

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers