CVE-2014-9025

The CVE corresponds to Drupal Commerce 7.x-1.x before 7.x-1.10, where the default checkout completion rule creates new user accounts with the email address as the username. This may disclose email addresses (information disclosure) to remote attackers via the checkout flow. Affected software: Dru...

CVE-2014-9025: Exposure of Sensitive Information to an Unauthorized Actor

The default checkout completion rule in the commerceorder module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new accounts created at checkout, which allows remote attackers to obtain sensitive information via unspecified vectors...