CVE-2015-2750

6.1MEDIUM

Key Information

Vendor: Drupal
Status: Drupal
Vendor: CVE Published:; 13 September 2017

Summary

Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence.

Refferences

http://www.debian.org/security/2015/dsa-3200

vendor-advisoryx_refsource_DEBIAN

http://www.openwall.com/lists/oss-security/2015/03/26/4

mailing-listx_refsource_MLIST

http://cgit.drupalcode.org/drupal/commit/includes/menu.in...

x_refsource_CONFIRM

http://www.securityfocus.com/bid/73219

vdb-entryx_refsource_BID

http://cgit.drupalcode.org/drupal/commit/includes/common....

x_refsource_CONFIRM

https://www.drupal.org/SA-CORE-2015-001

x_refsource_CONFIRM

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Sep 13, 2017
Vulnerability Reserved
Mar 26, 2015

Collectors

NVD DatabaseMitre Database