CVE-2015-3233
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote...
CVE-2015-3233 is a medium vulnerability (CVSS 5.8) in Drupal, published June 18, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.74%, the 86th percentile. No source names a fixed version.
- Severity
- 5.8 MediumCVSS 2.0, NVD
- Exploit chance
- 2.74%EPSS, 86th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal7Debian:7 From an advisory covering 4 CVEs | before 7.14-2+deb7u10, plus listed versions 7.14-27.14-2+deb7u17.14-2+deb7u10~bpo60+17.14-2+deb7u1~bpo60+17.14-2+deb7u2 Show 12 moreShow less7.14-2+deb7u2~bpo60+17.14-2+deb7u37.14-2+deb7u47.14-2+deb7u4~bpo60+17.14-2+deb7u57.14-2+deb7u67.14-2+deb7u6~bpo60+17.14-2+deb7u77.14-2+deb7u7~bpo60+17.14-2+deb7u87.14-2+deb7u97.14-2+deb7u9~bpo60+1 | 7.14-2+deb7u10 |
drupal7Debian:8 From an advisory covering 4 CVEs | before 7.32-1+deb8u4, plus listed versions 7.32-1+deb8u37.32-1+deb8u4~bpo70+1 | 7.32-1+deb8u4 |
drupalMageia:4 From an advisory covering 4 CVEs | before 7.38-1.mga4 | 7.38-1.mga4 |
drupalMageia:5 From an advisory covering 4 CVEs | before 7.38-1.mga5 | 7.38-1.mga5 |
drupal7Ubuntu:Pro:14.04:LTS | All versions, plus listed versions 7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3 | None known |
What each source reports
NVD Score used
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
- Record
CVE-2015-3233- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
CVE ListNo score
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
- Record
CVE-2015-3233- Updated
- 2026-11-02
EUVDEUVD-2015-3289No score
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
- Record
EUVD-2015-3289- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p68q-6jc7-9w28No score
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote...
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
- Record
GHSA-p68q-6jc7-9w28- Updated
- 2026-11-02
OSVMGASA-2015-0253No score
Updated drupal package fixes security vulnerability
Incorrect cache handling made private content viewed by "user 1" exposed to other, non-privileged users (CVE-2015-3231).
A flaw in the Field UI module made it possible for attackers to redirect users to malicious sites (CVE-2015-3232).
Due to insufficient URL validation, the Overlay module could be used to redirect users to malicious sites (CVE-2015-3233).
The OpenID module allowed an attacker to log in as other users, including administrators (CVE-2015-3234).
- Record
MGASA-2015-0253- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-3233No score
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
- Record
UBUNTU-CVE-2015-3233- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.fedoraproject.org/pipermail/package-announce/2015-July/161265.html
drupal.org/node/2507741
securityfocus.com/bid/75284
debian.org/security/2015/dsa-3291
Show 20 moreShow less
openwall.com/lists/oss-security/2015/07/04/4
nvd.nist.gov/vuln/detail/CVE-2015-3233
github.com/advisories/GHSA-p68q-6jc7-9w28
advisories.mageia.org/MGASA-2015-0253.html
bugs.mageia.org/show_bug.cgi?id=16147
ubuntu.com/security/CVE-2015-3233
cve.org/CVERecord?id=CVE-2015-3233