Drupal Core Overlay Module Open Redirection Vulnerability
BID:63843
Info
Drupal Core Overlay Module Open Redirection Vulnerability
| Bugtraq ID: | 63843 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-6389 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 20 2013 12:00AM |
| Updated: | Apr 13 2015 09:58PM |
| Credit: | Heine Deelstra of the Drupal Security Team |
| Vulnerable: |
Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Drupal Drupal 7.6 Drupal Drupal 7.5 Drupal Drupal 7.4 Drupal Drupal 7.3 Drupal Drupal 7.23 Drupal Drupal 7.20 Drupal Drupal 7.2 Drupal Drupal 7.19 Drupal Drupal 7.18 Drupal Drupal 7.17 Drupal Drupal 7.16 Drupal Drupal 7.15 Drupal Drupal 7.14 Drupal Drupal 7.13 Drupal Drupal 7.12 Drupal Drupal 7.11 Drupal Drupal 7.10 Drupal Drupal 7.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: |
Drupal Drupal 7.24 |
Discussion
Drupal Core Overlay Module Open Redirection Vulnerability
Drupal is prone to an open-redirection vulnerability because the application fails to properly sanitize user-supplied input.
An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.
Drupal versions 7.x through 7.24 are vulnerable.
Drupal is prone to an open-redirection vulnerability because the application fails to properly sanitize user-supplied input.
An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.
Drupal versions 7.x through 7.24 are vulnerable.
Exploit / POC
Drupal Core Overlay Module Open Redirection Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.