Drupal Language Switcher Dropdown Module Open Redirection Vulnerability

Bugtraq ID:	65078
Class:	Input Validation Error
CVE:	CVE-2014-9737
Remote:	Yes
Local:	No
Published:	Jan 22 2014 12:00AM
Updated:	Jul 15 2015 12:59AM
Credit:	Eric Peterson
Vulnerable:
Not Vulnerable:

Drupal Language Switcher Dropdown Module Open Redirection Vulnerability

The Language Switcher Dropdown module for Drupal is prone to an open-redirection vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.

Language Switcher Dropdown 7.x-1.x versions prior to 7.x-1.4 are vulnerable.

Drupal Language Switcher Dropdown Module Open Redirection Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Drupal Language Switcher Dropdown Module Open Redirection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Drupal Language Switcher Dropdown Module Open Redirection Vulnerability

References:

• Drupal Homepage (Drupal)