4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
51.9%
This module enables you to send emails using an external gateway and by default logs the contents of the messages. An attacker who gains access to the Mandrill dashboard can trigger password reset emails from the Drupal site, get the reset links from the Mandrill logs, and take over an account.
CVE: CVE-2012-5544
Drupal core is not affected. If you do not use the contributed Mandrill module, there is nothing you need to do.
Install the latest version:
Also see the Mandrill project page.
drupal.org/contact
drupal.org/node/1807894
drupal.org/project/mandrill
drupal.org/security-team
drupal.org/security-team/risk-levels
drupal.org/security/secure-configuration
drupal.org/user/1025236
drupal.org/user/36762
drupal.org/user/54135
drupal.org/user/798324
drupal.org/user/91990
drupal.org/writing-secure-code