CVE-2015-3232
Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote...
Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter.
Exploit likelihood
What each source reports
NVD Score used
Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter.
- Record
CVE-2015-3232- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter.
- Record
CVE-2015-3232- Updated
- 2026-11-02
EUVDEUVD-2015-3288 No score
Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter.
- Record
EUVD-2015-3288- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pfc2-6vvp-c5mq No score
Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote...
Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter.
- Record
GHSA-pfc2-6vvp-c5mq- Updated
- 2026-11-02
OSVMGASA-2015-0253 No score
Updated drupal package fixes security vulnerability
Incorrect cache handling made private content viewed by "user 1" exposed to other, non-privileged users (CVE-2015-3231).
A flaw in the Field UI module made it possible for attackers to redirect users to malicious sites (CVE-2015-3232).
Due to insufficient URL validation, the Overlay module could be used to redirect users to malicious sites (CVE-2015-3233).
The OpenID module allowed an attacker to log in as other users, including administrators (CVE-2015-3234).
- Record
MGASA-2015-0253- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-3232 No score
Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter.
- Record
UBUNTU-CVE-2015-3232- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal7Debian:7 |
before 7.14-2+deb7u10, plus listed versions 7.14-27.14-2+deb7u17.14-2+deb7u10~bpo60+17.14-2+deb7u1~bpo60+17.14-2+deb7u2 Show 12 moreShow less7.14-2+deb7u2~bpo60+17.14-2+deb7u37.14-2+deb7u47.14-2+deb7u4~bpo60+17.14-2+deb7u57.14-2+deb7u67.14-2+deb7u6~bpo60+17.14-2+deb7u77.14-2+deb7u7~bpo60+17.14-2+deb7u87.14-2+deb7u97.14-2+deb7u9~bpo60+1 |
7.14-2+deb7u10 |
drupal7Debian:8 |
before 7.32-1+deb8u4, plus listed versions 7.32-1+deb8u37.32-1+deb8u4~bpo70+1 |
7.32-1+deb8u4 |
drupalMageia:4 |
before 7.38-1.mga4 | 7.38-1.mga4 |
drupalMageia:5 |
before 7.38-1.mga5 | 7.38-1.mga5 |
drupal7Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-3232 is a medium vulnerability (CVSS 5.8) in Drupal, published June 18, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.89%, the 79th percentile. Fixed in drupal7 7.14-2+deb7u10.
References
lists.fedoraproject.org/pipermail/package-announce/2015-July/161265.html
debian.org/security/2015/dsa-3291
drupal.org/SA-CORE-2015-002
securityfocus.com/bid/75287
nvd.nist.gov/vuln/detail/CVE-2015-3232
Show 12 moreShow less
github.com/advisories/GHSA-pfc2-6vvp-c5mq
advisories.mageia.org/MGASA-2015-0253.html
bugs.mageia.org/show_bug.cgi?id=16147
ubuntu.com/security/CVE-2015-3232
cve.org/CVERecord?id=CVE-2015-3232