CVE-2015-2750
UnknownEPSS 1.38%
Last modified
CVE-2015-2750 is a vulnerability of currently unknown severity. Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence.. EPSS estimates a 1.38% chance of exploitation in the next 30 days.
Description
Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Drupal | Drupal | 6.0 |
| Drupal | Drupal | 6.1 |
| Drupal | Drupal | 6.2 |
| Drupal | Drupal | 6.3 |
| Drupal | Drupal | 6.4 |
| Drupal | Drupal | 6.5 |
| Drupal | Drupal | 6.6 |
| Drupal | Drupal | 6.7 |
| Drupal | Drupal | 6.8 |
| Drupal | Drupal | 6.9 |
| Drupal | Drupal | 6.10 |
| Drupal | Drupal | 6.11 |
| Drupal | Drupal | 6.12 |
| Drupal | Drupal | 6.13 |
| Drupal | Drupal | 6.14 |
| Drupal | Drupal | 6.15 |
| Drupal | Drupal | 6.16 |
| Drupal | Drupal | 6.17 |
| Drupal | Drupal | 6.18 |
| Drupal | Drupal | 6.19 |
| Drupal | Drupal | 6.20 |
| Drupal | Drupal | 6.21 |
| Drupal | Drupal | 6.22 |
| Drupal | Drupal | 6.23 |
| Drupal | Drupal | 6.24 |
| Drupal | Drupal | 6.25 |
| Drupal | Drupal | 6.26 |
| Drupal | Drupal | 6.27 |
| Drupal | Drupal | 6.28 |
| Drupal | Drupal | 6.29 |
| Drupal | Drupal | 6.30 |
| Drupal | Drupal | 6.31 |
| Drupal | Drupal | 6.32 |
| Drupal | Drupal | 6.33 |
| Drupal | Drupal | 6.34 |
| Drupal | Drupal | 7.0 |
| Drupal | Drupal | 7.1 |
| Drupal | Drupal | 7.2 |
| Drupal | Drupal | 7.3 |
| Drupal | Drupal | 7.4 |
| Drupal | Drupal | 7.5 |
| Drupal | Drupal | 7.6 |
| Drupal | Drupal | 7.7 |
| Drupal | Drupal | 7.8 |
| Drupal | Drupal | 7.9 |
| Drupal | Drupal | 7.10 |
| Drupal | Drupal | 7.11 |
| Drupal | Drupal | 7.12 |
| Drupal | Drupal | 7.13 |
| Drupal | Drupal | 7.14 |
Showing 50 of 72 affected configurations. See NVD for the full list.
References
- http://cgit.drupalcode.org/drupal/commit/includes/menu.inc?h=6.x&id=8ffc5db3c0ab926f3d4b2cf8bc51714c8c0f3c93Patch, Third Party Advisory
- http://www.debian.org/security/2015/dsa-3200Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/03/26/4Mailing List, Patch, VDB Entry
- http://www.securityfocus.com/bid/73219Third Party Advisory, VDB Entry
- https://www.drupal.org/SA-CORE-2015-001Patch, Vendor Advisory
- http://cgit.drupalcode.org/drupal/commit/includes/menu.inc?h=6.x&id=8ffc5db3c0ab926f3d4b2cf8bc51714c8c0f3c93Patch, Third Party Advisory
- http://www.debian.org/security/2015/dsa-3200Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/03/26/4Mailing List, Patch, VDB Entry
- http://www.securityfocus.com/bid/73219Third Party Advisory, VDB Entry
- https://www.drupal.org/SA-CORE-2015-001Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-2750?
Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence.
How severe is CVE-2015-2750?
Severity scoring for CVE-2015-2750 is pending analysis. The EPSS model estimates a 1.38% probability of exploitation in the next 30 days.
How do I fix CVE-2015-2750?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-2744Cross-site scripting (XSS) vulnerability in the Search app i…
- CVE-2015-2745Multiple cross-site scripting (XSS) vulnerabilities in the S…
- CVE-2015-2746The network diagnostics tool (CommandLineServlet) in the App…
- CVE-2015-2747Multiple cross-site scripting (XSS) vulnerabilities in the d…
- CVE-2015-2748Websense TRITON AP-WEB before 8.0.0 does not properly restri…
- CVE-2015-2749Open redirect vulnerability in Drupal 6.x before 6.35 and 7.…
- CVE-2015-2751Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggrega…
- CVE-2015-2752The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through…
- CVE-2015-2753FreeXL before 1.0.0i allows remote attackers to cause a deni…
- CVE-2015-2754FreeXL before 1.0.0i allows remote attackers to cause a deni…
- CVE-2015-2755Multiple cross-site request forgery (CSRF) vulnerabilities i…
- CVE-2015-2756QEMU, as used in Xen 3.3.x through 4.5.x, does not properly …
Are you affected by CVE-2015-2750?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST