CVE-2015-3378

Open redirect vulnerability in the Views module before 6.x-2.18, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.10 for Drupal, when the Views UI submodule is enabled, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via vectors related to the break lock page for edited views.

• http://www.openwall.com/lists/oss-security/2015/02/13/12
• http://www.securityfocus.com/bid/72590
• https://www.drupal.org/node/2424097Patch
• https://www.drupal.org/node/2424101Patch
• https://www.drupal.org/node/2424103Patch
• https://www.drupal.org/node/2424403Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2015/02/13/12
• http://www.securityfocus.com/bid/72590
• https://www.drupal.org/node/2424097Patch
• https://www.drupal.org/node/2424101Patch
• https://www.drupal.org/node/2424103Patch
• https://www.drupal.org/node/2424403Patch, Vendor Advisory

Published

Apr 21, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-3372Cross-site scripting (XSS) vulnerability in the Node Invite …
• CVE-2015-3373The Amazon AWS module before 7.x-1.3 for Drupal uses the bas…
• CVE-2015-3374Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2015-3375Cross-site request forgery (CSRF) vulnerability in the Shibb…
• CVE-2015-3376Cross-site scripting (XSS) vulnerability in the Quizzler mod…
• CVE-2015-3377Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-3379The Views module before 6.x-2.18, 6.x-3.x before 6.x-3.2, an…
• CVE-2015-3380Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2015-3381Cross-site scripting (XSS) vulnerability in the Node basket …
• CVE-2015-3382Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2015-3383Open redirect vulnerability in the Node basket module for Dr…
• CVE-2015-3384Cross-site scripting (XSS) vulnerability in the Bank Account…