Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233.

Two vulnerabilities were discovered in Drupal, a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2015-7943     Samuel Mortenson and Pere Orga discovered that the     overlay module does not sufficiently validate URLs prior     to displaying their contents, leading to an open     redirect vulnerability.

  More information can be found at   https://www.drupal.org/SA-CORE-2015-004

  - CVE-2017-6922     Greg Knaddison, Mori Sugimoto and iancawthorne     discovered that files uploaded by anonymous users into a     private file system can be accessed by other anonymous     users leading to an access bypass vulnerability.

  More information can be found at   https://www.drupal.org/SA-CORE-2017-003

It was discovered that there was an open redirect vulnerability in drupal7, a content management framework.

The 'Overlay' module in Drupal core displays administrative pages as a layer over the current page (using JavaScript) rather than replacing the page in the browser window. The module did not sufficiently validate URLs prior to displaying their contents, leading to an open redirect vulnerability.

For Debian 7 'Wheezy', this issue has been fixed in drupal7 version 7.14-2+deb7u13.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote web server is running a version of Drupal that is 7.x prior to 7.41. It is, therefore, affected by an open redirect vulnerability in the Overlay module due to improper validation of URLs before displaying their contents. An unauthenticated, remote attacker can exploit this, via a specially crafted URL, to redirect a victim from an intended legitimate website to an arbitrary website. This vulnerability can only be exploited against Drupal users who have both the 'Access the administrative overlay' permission and the Overlay module enabled. 

drupal7-7.41-1.fc21 - 7.41. drupal7-7.41-1.fc22 - 7.41.
drupal7-7.41-1.el5 - 7.41. drupal7-7.41-1.el6 - 7.41.
drupal7-7.41-1.el7

  - 7.41. drupal7-7.41-1.fc23 - 7.41.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

drupal7-7.41-1.fc21 - 7.41. drupal7-7.41-1.fc22 - 7.41.
drupal7-7.41-1.el5 - 7.41. drupal7-7.41-1.el6 - 7.41.
drupal7-7.41-1.el7

  - 7.41. drupal7-7.41-1.fc23 - 7.41. ----     drupal7-7.40-1.fc21 - 7.40. drupal7-7.40-1.fc22 - 7.40.
    drupal7-7.40-1.el5 - 7.40. drupal7-7.40-1.el6

  - 7.40. drupal7-7.40-1.el7 - 7.40. drupal7-7.40-1.fc23 -     7.40.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote web server is running a version of Drupal that is 7.x prior to 7.41. It is, therefore, affected by an open redirect vulnerability in the Overlay module due to improper validation of URLs before displaying their contents. An unauthenticated, remote attacker can exploit this, via a specially crafted URL, to redirect a victim from an intended legitimate website to an arbitrary website.

This vulnerability can only be exploited against Drupal users who have both the 'Access the administrative overlay' permission and the Overlay module enabled. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Drupal development team reports :

The Overlay module in Drupal core displays administrative pages as a layer over the current page (using JavaScript), rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect vulnerability.

This vulnerability is mitigated by the fact that it can only be used against site users who have the 'Access the administrative overlay' permission, and that the Overlay module must be enabled.

An incomplete fix for this issue was released as part of SA-CORE-2015-002.

ID	Name	Product	Family	Severity
101034	Debian DSA-3897-1 : drupal7 - security update	Nessus	Debian Local Security Checks	medium
92003	Debian DLA-548-1 : drupal7 security update	Nessus	Debian Local Security Checks	medium
9219	Drupal 7.x < 7.41 Overlay Module Open Redirect	Nessus Network Monitor	CGI	low
89411	Fedora 23 : drupal7-7.41-1.fc23 (2015-ccf2b449a9)	Nessus	Fedora Local Security Checks	medium
89409	Fedora 22 : drupal7-7.41-1.fc22 (2015-cb94fd13d8)	Nessus	Fedora Local Security Checks	medium
86673	Drupal 7.x < 7.41 Overlay Module Open Redirect	Nessus	CGI abuses	medium
86587	FreeBSD : drupal -- open redirect vulnerability (75f39413-7a00-11e5-a2a1-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-7943

medium

Tenable Plugins

medium

medium

low

medium

medium

medium

medium