CVE-2014-8735

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-11-12 · updated 2026-06-17
Weakness: CWE-200

Description

The Bad Behavior module 6.x-2.x before 6.x-2.2216 and 7.x-2.x before 7.x-2.2216 for Drupal logs usernames and passwords, which allows remote authenticated users with the "administer bad behavior" permission to obtain sensitive information by reading a log file.

Affected products

Bad Behavior Project Bad Behavior: 6.x-1.0-rc1, 6.x-1.0-rc2, 6.x-1.x-dev, 6.x-2.1, 6.x-2.2-rc14, 6.x-2.13 (+40)

References

https://www.drupal.org/node/2360953
https://www.drupal.org/node/2360955
https://www.drupal.org/node/2361611
https://www.drupal.org/node/2360953
https://www.drupal.org/node/2360955
https://www.drupal.org/node/2361611

Get alerted when CVE-2014-8735 or the next vulnerability affects your stack