The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.

The remote server is hosting an outdated version of Drupal, a PHP-based open-source content management system. The version of Drupal installed on the remote server is 7.x prior to 7.38, and is affected by the following vulnerabilities :

 - An open redirect vulnerability exists due to improper validation of user-supplied input to the 'destinations' parameter in the Field UI module. A remote attacker can exploit this issue, via a specially crafted URL, to redirect users to a third-party website. (CVE-2015-3231)
 - An open redirect vulnerability exists due to improper validation of URLs prior displaying their contents via the Overlay module on administrative pages. (CVE-2015-3232)
 - An information disclosure vulnerability exists due to a flaw in the render cache system. An attacker can exploit this flaw to view private content of arbitrary users. (CVE-2015-3233)
 - A security bypass vulnerability exists due to a flaw in the OpenID module. A remote attacker can exploit this flaw to log in as other users, including administrators. Note that victims must have an existing OpenID account from a particular set of OpenID providers including, but not limited to, Verisign, LiveJournal, or StackExchange. (CVE-2015-3234)

The remote web server is running a version of Drupal that is 6.x prior to 6.36. It is, therefore, potentially affected by a security bypass vulnerability due to a flaw in the OpenID module. A remote attacker can exploit this flaw to log in as other users, including administrators. Note that victims must have an existing OpenID account from a particular set of OpenID providers including, but not limited to, Verisign, LiveJournal, or StackExchange.

- Release 7.38 is a security fix release

    - Upstream release notes:
      https://www.drupal.org/drupal-7.38-release-notes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were found in drupal7, a content management platform used to power websites.

  - CVE-2015-3231     Incorrect cache handling made private content viewed by     'user 1' exposed to other, non-privileged users.

  - CVE-2015-3232     A flaw in the Field UI module made it possible for     attackers to redirect users to malicious sites.

  - CVE-2015-3233     Due to insufficient URL validation, the Overlay module     could be used to redirect users to malicious sites.

  - CVE-2015-3234     The OpenID module allowed an attacker to log in as other     users, including administrators.

The remote web server is running a version of Drupal that is 7.x prior to 7.38. It is, therefore, potentially affected by the following vulnerabilities :

  - An open redirect vulnerability exists due to improper     validation of user-supplied input to the 'destinations'     parameter in the Field UI module. A remote attacker can     exploit this issue, via a specially crafted URL, to     redirect users to a third-party website. (CVE-2015-3231)

  - An open redirect vulnerability exists due to improper     validation of URLs prior displaying their contents via     the Overlay module on administrative pages.
    (CVE-2015-3232)

  - An information disclosure vulnerability exists due to a     flaw in the render cache system. An attacker can exploit     this flaw to view private content of arbitrary users.
    (CVE-2015-3233)

  - A security bypass vulnerability exists due to a flaw in     the OpenID module. A remote attacker can exploit this     flaw to log in as other users, including administrators.
    Note that victims must have an existing OpenID account     from a particular set of OpenID providers including,     but not limited to, Verisign, LiveJournal, or     StackExchange. (CVE-2015-3234)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote web server is running a version of Drupal that is 6.x prior to 6.36. It is, therefore, potentially affected by a security bypass vulnerability due to a flaw in the OpenID module. A remote attacker can exploit this flaw to log in as other users, including administrators. Note that victims must have an existing OpenID account from a particular set of OpenID providers including, but not limited to, Verisign, LiveJournal, or StackExchange. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Drupal development team reports : Impersonation (OpenID module - Drupal 6 and 7 - Critical) A vulnerability was found in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their accounts.

This vulnerability is mitigated by the fact that the victim must have an account with an associated OpenID identity from a particular set of OpenID providers (including, but not limited to, Verisign, LiveJournal, or StackExchange). Open redirect (Field UI module - Drupal 7 - Less critical) The Field UI module uses a 'destinations' query string parameter in URLs to redirect users to new destinations after completing an action on a few administration pages. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks.

This vulnerability is mitigated by the fact that only sites with the Field UI module enabled are affected.

Drupal 6 core is not affected, but see the similar advisory for the Drupal 6 contributed CCK module : SA-CONTRIB-2015-126 Open redirect (Overlay module - Drupal 7 - Less critical) The Overlay module displays administrative pages as a layer over the current page (using JavaScript), rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect vulnerability.

This vulnerability is mitigated by the fact that it can only be used against site users who have the 'Access the administrative overlay' permission, and that the Overlay module must be enabled. Information disclosure (Render cache system - Drupal 7 - Less critical) On sites utilizing Drupal 7's render cache system to cache content on the site by user role, private content viewed by user 1 may be included in the cache and exposed to non-privileged users.

This vulnerability is mitigated by the fact that render caching is not used in Drupal 7 core itself (it requires custom code or the contributed Render Cache module to enable) and that it only affects sites that have user 1 browsing the live site. Exposure is also limited if an administrative role has been assigned to the user 1 account (which is done, for example, by the Standard install profile that ships with Drupal core).

ID	Name	Product	Family	Severity
9217	Drupal 7.x < 7.38 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
9214	Drupal 6.x < 6.36 OpenID Security Bypass	Nessus Network Monitor	CGI	medium
84514	Fedora 22 : drupal7-7.38-1.fc22 (2015-10290)	Nessus	Fedora Local Security Checks	medium
84513	Fedora 21 : drupal7-7.38-1.fc21 (2015-10189)	Nessus	Fedora Local Security Checks	medium
84298	Debian DSA-3291-1 : drupal7 - security update	Nessus	Debian Local Security Checks	medium
84292	Drupal 7.x < 7.38 Multiple Vulnerabilities	Nessus	CGI abuses	medium
84291	Drupal 6.x < 6.36 OpenID Security Bypass	Nessus	CGI abuses	medium
84282	FreeBSD : drupal -- multiple vulnerabilities (d605edb1-1616-11e5-a000-d050996490d0)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-3234

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium