CVE-2015-5501

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Hostmaster (Aegir) module 6.x-2.x before 6.x-2.4 and 7.x-3.x before 7.x-3.0-beta2 for Drupal allows remote attackers to execute arbitrary PHP code via a crafted file in the directory used to write Apache vhost files for hosted sites in a multi-site environment.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-254

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://community.aegirproject.org/2.4Vendor Advisory
http://community.aegirproject.org/3.0-beta2Vendor Advisory
http://www.openwall.com/lists/oss-security/2015/07/04/4
http://www.securityfocus.com/bid/74759
https://www.drupal.org/node/2492317Vendor Advisory
http://community.aegirproject.org/2.4Vendor Advisory
http://community.aegirproject.org/3.0-beta2Vendor Advisory
http://www.openwall.com/lists/oss-security/2015/07/04/4
http://www.securityfocus.com/bid/74759
https://www.drupal.org/node/2492317Vendor Advisory

Timeline

Published: Aug 18, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-55027.5The Storage API module 7.x-1.x before 7.x-1.8 for Drupal does not properly restrict access to Storage API fields attached to entities that a CVE-2015-55035.8Open redirect vulnerability in the Chamilo integration module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to redirect users to CVE-2015-55047.5SQL injection vulnerability in the Novalnet Payment Module Ubercart module for Drupal allows remote attackers to execute arbitrary SQL comma CVE-2015-55056.8The HTTP Strict Transport Security (HSTS) module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly implement th CVE-2015-55065.0The Apache Solr Real-Time module 7.x-1.x before 7.x-1.2 for Drupal does not check the status of an entity when indexing, which allows remote CVE-2015-55074.3Cross-site scripting (XSS) vulnerability in the Inline Entity Form module 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated user CVE-2015-55085.1Cross-site request forgery (CSRF) vulnerability in the XC NCIP Provider module in the eXtensible Catalog (XC) Drupal Toolkit allows remote a CVE-2015-55096.0The Administration Views module 7.x-1.x before 7.x-1.4 for Drupal, when used with other unspecified modules, does not properly grant access CVE-2015-55105.8Open redirect vulnerability in the Content Construction Kit (CCK) 6.x-2.x before 6.x-2.10 for Drupal allows remote attackers to redirect use CVE-2015-55115.0The HybridAuth Social Login module 7.x-2.x before 7.x-2.13 for Drupal allows remote attackers to bypass the user registration by administrat CVE-2015-55125.0The me aliases module 6.x-2.x before 6.x-2.10 and 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to access Views using the "me" u CVE-2015-55132.1Cross-site scripting (XSS) vulnerability in the Shibboleth authentication module 6.x-4.x before 6.x-4.2 and 7.x-4.x before 7.x-4.2 for Drupa