VulnerabilityModified

CVE-2015-2750

Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence.

MEDIUM 6.1EPSS 1.38%

Does this matter?

Lower severity and a low EPSS score (1.38%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.0: 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 1.38% probability · 70th percentile
CISA KEV: Not listed
Weakness: CWE-601
Affected: drupal/drupal · debian/debian linux
Source: cve@mitre.org

References

http://cgit.drupalcode.org/drupal/commit/includes/common.inc?h=7.x&id=b44056d2f8e8c71d35c85ec5c2fb8f7c8a02d8a8Third Party Advisory
http://cgit.drupalcode.org/drupal/commit/includes/menu.inc?h=6.x&id=8ffc5db3c0ab926f3d4b2cf8bc51714c8c0f3c93Patch, Third Party Advisory
http://www.debian.org/security/2015/dsa-3200Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/03/26/4Mailing List, Patch, VDB Entry
http://www.securityfocus.com/bid/73219Third Party Advisory, VDB Entry
https://www.drupal.org/SA-CORE-2015-001Patch, Vendor Advisory
http://cgit.drupalcode.org/drupal/commit/includes/common.inc?h=7.x&id=b44056d2f8e8c71d35c85ec5c2fb8f7c8a02d8a8Third Party Advisory
http://cgit.drupalcode.org/drupal/commit/includes/menu.inc?h=6.x&id=8ffc5db3c0ab926f3d4b2cf8bc51714c8c0f3c93Patch, Third Party Advisory
http://www.debian.org/security/2015/dsa-3200Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/03/26/4Mailing List, Patch, VDB Entry
http://www.securityfocus.com/bid/73219Third Party Advisory, VDB Entry
https://www.drupal.org/SA-CORE-2015-001Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.