CVE-2014-9025

The CVE corresponds to Drupal Commerce 7.x-1.x before 7.x-1.10, where the default checkout completion rule creates new user accounts with the email address as the username. This may disclose email addresses (information disclosure) to remote attackers via the checkout flow. Affected software: Dru...