Lucene search

MitreCVE-2015-3378

HistoryApr 21, 2015 - 6:59 p.m.

CVE-2015-3378

2015-04-2118:59:00

mitre

web.nvd.nist.gov

cve-2015-3378

views module

drupal

open redirect vulnerability

views ui submodule

CVSS2

4.9

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

AI Score

6.4

Confidence

Low

EPSS

0.001

Percentile

50.9%

JSON

Open redirect vulnerability in the Views module before 6.x-2.18, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.10 for Drupal, when the Views UI submodule is enabled, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via vectors related to the break lock page for edited views.

Affected configurations

Nvd

Node

views_projectviewsRange≤6.x-2.16drupal

views_projectviewsMatch6.x-3.0drupal

views_projectviewsMatch6.x-3.0alpha1drupal

views_projectviewsMatch6.x-3.0alpha2drupal

views_projectviewsMatch6.x-3.0alpha3drupal

views_projectviewsMatch6.x-3.0alpha4drupal

views_projectviewsMatch6.x-3.0rc2drupal

views_projectviewsMatch6.x-3.0rc3drupal

views_projectviewsMatch7.x-3.0drupal

views_projectviewsMatch7.x-3.0alpha1drupal

views_projectviewsMatch7.x-3.0beta1drupal

views_projectviewsMatch7.x-3.0beta2drupal

views_projectviewsMatch7.x-3.0beta3drupal

views_projectviewsMatch7.x-3.0rc1drupal

views_projectviewsMatch7.x-3.0rc3drupal

views_projectviewsMatch7.x-3.1drupal

views_projectviewsMatch7.x-3.2drupal

views_projectviewsMatch7.x-3.3drupal

views_projectviewsMatch7.x-3.4drupal

views_projectviewsMatch7.x-3.5drupal

views_projectviewsMatch7.x-3.6drupal

views_projectviewsMatch7.x-3.7drupal

views_projectviewsMatch7.x-3.8drupal

views_projectviewsMatch7.x-3.xdevdrupal

VendorProductVersionCPE
views_projectviews*cpe:2.3:a:views_project:views:*:*:*:*:*:drupal:*:*
views_projectviews6.x-3.0cpe:2.3:a:views_project:views:6.x-3.0:*:*:*:*:drupal:*:*
views_projectviews6.x-3.0cpe:2.3:a:views_project:views:6.x-3.0:alpha1:*:*:*:drupal:*:*
views_projectviews6.x-3.0cpe:2.3:a:views_project:views:6.x-3.0:alpha2:*:*:*:drupal:*:*
views_projectviews6.x-3.0cpe:2.3:a:views_project:views:6.x-3.0:alpha3:*:*:*:drupal:*:*
views_projectviews6.x-3.0cpe:2.3:a:views_project:views:6.x-3.0:alpha4:*:*:*:drupal:*:*
views_projectviews6.x-3.0cpe:2.3:a:views_project:views:6.x-3.0:rc2:*:*:*:drupal:*:*
views_projectviews6.x-3.0cpe:2.3:a:views_project:views:6.x-3.0:rc3:*:*:*:drupal:*:*
views_projectviews7.x-3.0cpe:2.3:a:views_project:views:7.x-3.0:*:*:*:*:drupal:*:*
views_projectviews7.x-3.0cpe:2.3:a:views_project:views:7.x-3.0:alpha1:*:*:*:drupal:*:*

Vendor	Product	Version	CPE
views_project	views	*	cpe:2.3:a:views_project:views::::::drupal::*
views_project	views	6.x-3.0	cpe:2.3:a:views_project:views:6.x-3.0:::::drupal::
views_project	views	6.x-3.0	cpe:2.3:a:views_project:views:6.x-3.0:alpha1::::drupal::*
views_project	views	6.x-3.0	cpe:2.3:a:views_project:views:6.x-3.0:alpha2::::drupal::*
views_project	views	6.x-3.0	cpe:2.3:a:views_project:views:6.x-3.0:alpha3::::drupal::*
views_project	views	6.x-3.0	cpe:2.3:a:views_project:views:6.x-3.0:alpha4::::drupal::*
views_project	views	6.x-3.0	cpe:2.3:a:views_project:views:6.x-3.0:rc2::::drupal::*
views_project	views	6.x-3.0	cpe:2.3:a:views_project:views:6.x-3.0:rc3::::drupal::*
views_project	views	7.x-3.0	cpe:2.3:a:views_project:views:7.x-3.0:::::drupal::
views_project	views	7.x-3.0	cpe:2.3:a:views_project:views:7.x-3.0:alpha1::::drupal::*

Rows per page:

1-10 of 241

References

www.openwall.com/lists/oss-security/2015/02/13/12

www.securityfocus.com/bid/72590

www.drupal.org/node/2424097

www.drupal.org/node/2424101

www.drupal.org/node/2424103

www.drupal.org/node/2424403

CVSS2

4.9

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

AI Score

6.4

Confidence

Low

EPSS

0.001

Percentile

50.9%

JSON

Related for CVE-2015-3378