CVE-2015-3233

Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote...

5.8 Medium

Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Exploit likelihood

2.74%Down 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 5.8

Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Record: CVE-2015-3233
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Updated: 2026-11-02

CVE List No score

Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Record: CVE-2015-3233
Updated: 2026-11-02

EUVDEUVD-2015-3289 No score

Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Record: EUVD-2015-3289
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p68q-6jc7-9w28 No score

Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote...

Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Record: GHSA-p68q-6jc7-9w28
Updated: 2026-11-02

OSVMGASA-2015-0253 No score

Updated drupal package fixes security vulnerability

Incorrect cache handling made private content viewed by "user 1" exposed to other, non-privileged users (CVE-2015-3231).

A flaw in the Field UI module made it possible for attackers to redirect users to malicious sites (CVE-2015-3232).

Due to insufficient URL validation, the Overlay module could be used to redirect users to malicious sites (CVE-2015-3233).

The OpenID module allowed an attacker to log in as other users, including administrators (CVE-2015-3234).

Record: MGASA-2015-0253
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-3233 No score

Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Record: UBUNTU-CVE-2015-3233
Updated: 2026-11-02

Affected products

drupal

Affected packages

Affected packages
Package	Affected	Fixed
`drupal7` Debian:7 From an advisory covering 4 CVEs	before 7.14-2+deb7u10, plus listed versions 7.14-27.14-2+deb7u17.14-2+deb7u10~bpo60+17.14-2+deb7u1~bpo60+17.14-2+deb7u2 Show 12 moreShow less 7.14-2+deb7u2~bpo60+17.14-2+deb7u37.14-2+deb7u47.14-2+deb7u4~bpo60+17.14-2+deb7u57.14-2+deb7u67.14-2+deb7u6~bpo60+17.14-2+deb7u77.14-2+deb7u7~bpo60+17.14-2+deb7u87.14-2+deb7u97.14-2+deb7u9~bpo60+1	7.14-2+deb7u10
`drupal7` Debian:8 From an advisory covering 4 CVEs	before 7.32-1+deb8u4, plus listed versions 7.32-1+deb8u37.32-1+deb8u4~bpo70+1	7.32-1+deb8u4
`drupal` Mageia:4 From an advisory covering 4 CVEs	before 7.38-1.mga4	7.38-1.mga4
`drupal` Mageia:5 From an advisory covering 4 CVEs	before 7.38-1.mga5	7.38-1.mga5
`drupal7` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-3233 is a medium vulnerability (CVSS 5.8) in Drupal, published June 18, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.74%, the 86th percentile. No source names a fixed version.

References

Show 20 moreShow less