CVE-2015-2749

6.1MEDIUM

Key Information

Vendor: Drupal
Status: Drupal
Vendor: CVE Published:; 13 September 2017

Summary

Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.

Refferences

http://cgit.drupalcode.org/drupal/commit/?id=d2304f840c43...

x_refsource_CONFIRM

http://www.debian.org/security/2015/dsa-3200

vendor-advisoryx_refsource_DEBIAN

http://www.openwall.com/lists/oss-security/2015/03/26/4

mailing-listx_refsource_MLIST

https://bugzilla.redhat.com/show_bug.cgi?id=1204753

x_refsource_CONFIRM

http://www.securityfocus.com/bid/73219

vdb-entryx_refsource_BID

https://www.drupal.org/SA-CORE-2015-001

x_refsource_CONFIRM

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Sep 13, 2017
Vulnerability Reserved
Mar 26, 2015

Collectors

NVD DatabaseMitre Database