PT-2017-6610

CVE-2015-2750

Published

2015-03-20

Updated

2021-03-15

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x through 6.34 Drupal versions 7.x through 7.34

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence in URL-related API functions.

Recommendations For Drupal versions 6.x through 6.34, update to version 6.35 or later. For Drupal versions 7.x through 7.34, update to version 7.35 or later.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-601: URL Redirection to Untrusted Site (\'Open Redirect\')

Related identifiers

CVE-2015-2750

DSA-3200-1

MGASA-2015-0121