CVE-2014-3704

Key facts

CVSS score

7.5 (v2.0)

Severity

HIGH

CVSS vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness (CWE)

CWE-89

EPSS score

100.0% (100th percentile)

In CISA KEV

No

In EU EUVD

Yes (EUVD-2014-3650)

Published

October 16, 2014

NVD last modified

June 17, 2026

Status

Modified

Affected products

• debian / debian linux
• drupal / drupal

References

• http://osvdb.org/show/osvdb/113371(Broken Link)
• http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html(Exploit, Third Party Advisory, VDB Entry)
• http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html(Exploit, Third Party Advisory, VDB Entry)
• http://packetstormsecurity.com/files/128741/Drupal-HTTP-Parameter-Key-Value-SQL-Injection.html(Exploit, Third Party Advisory, VDB Entry)
• http://seclists.org/fulldisclosure/2014/Oct/75(Exploit, Mailing List, Patch, Third Party Advisory)
• http://secunia.com/advisories/59972(Third Party Advisory)
• http://www.debian.org/security/2014/dsa-3051(Third Party Advisory)
• http://www.exploit-db.com/exploits/34984(Exploit, Third Party Advisory, VDB Entry)
• http://www.exploit-db.com/exploits/34992(Exploit, Third Party Advisory, VDB Entry)
• http://www.exploit-db.com/exploits/34993(Exploit, Third Party Advisory, VDB Entry)
• http://www.exploit-db.com/exploits/35150(Exploit, Third Party Advisory, VDB Entry)
• http://www.openwall.com/lists/oss-security/2014/10/15/23(Exploit, Mailing List, Patch)
• http://www.securityfocus.com/archive/1/533706/100/0/threaded(Third Party Advisory, VDB Entry)
• http://www.securityfocus.com/bid/70595(Third Party Advisory, VDB Entry)
• https://www.drupal.org/SA-CORE-2014-005(Patch, Vendor Advisory)
• https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html(Exploit, Patch, Third Party Advisory)
• https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html(Exploit, Third Party Advisory)