{"id":"CVE-2015-7943","aliases":["DEBIAN-CVE-2015-7943","DLA-548-1","EUVD-2015-7840","GHSA-5746-cvmj-7x62","MGASA-2015-0425","UBUNTU-CVE-2015-7943"],"status":"published","title":"Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update...","description":"Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01774,"percentile":0.7834,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2015-11-04T18:03:05Z","modified":"2026-06-17T00:33:25Z","fixes":[{"ecosystem":"Debian:7","package":"drupal7","fixed_in":["7.14-2+deb7u13"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"drupal","fixed_in":["7.41-1.1.mga5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14-2+deb7u13"}]}],"versions":["7.14-2","7.14-2+deb7u1","7.14-2+deb7u10","7.14-2+deb7u10~bpo60+1","7.14-2+deb7u11","7.14-2+deb7u11~bpo60+1","7.14-2+deb7u12","7.14-2+deb7u1~bpo60+1","7.14-2+deb7u2","7.14-2+deb7u2~bpo60+1","7.14-2+deb7u3","7.14-2+deb7u4","7.14-2+deb7u4~bpo60+1","7.14-2+deb7u5","7.14-2+deb7u6","7.14-2+deb7u6~bpo60+1","7.14-2+deb7u7","7.14-2+deb7u7~bpo60+1","7.14-2+deb7u8","7.14-2+deb7u9","7.14-2+deb7u9~bpo60+1"]},{"source":"osv","ecosystem":"Mageia:5","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.41-1.1.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1","7.26-1ubuntu0.1+esm2","7.26-1ubuntu0.1+esm3"]}],"products":[{"vendor":"drupal","product":"drupal"},{"vendor":"jquery_update_project","product":"jquery_update"},{"vendor":"labjs_project","product":"labjs"}],"references":[{"url":"https://www.drupal.org/node/2598434","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/77293","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2015-10-21/drupal-core-overlay-less-critical","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://www.drupal.org/node/2598426","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"http://www.debian.org/security/2017/dsa-3897","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7943"},{"url":"https://github.com/advisories/GHSA-5746-cvmj-7x62"},{"url":"https://advisories.mageia.org/MGASA-2015-0425.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16997","tags":["report"]},{"url":"https://www.drupal.org/SA-CORE-2015-004","tags":["web","report"]},{"url":"https://www.drupal.org/drupal-7.40","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.40-release-notes","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.41","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.41-release-notes","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2015/10/23/6","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-7943","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/10/21/6","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7943","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-7943","description":"Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233.","status":"published","published":"2017-10-18T18:00:00Z","modified":"2024-08-06T08:06:31.133Z","updated_at":"2026-11-02T14:35:44.404481Z"}],"euvd":[{"id":"EUVD-2015-7840","description":"Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233.","status":"published","published":"2017-10-18T18:00:00Z","modified":"2024-08-06T08:06:31Z","updated_at":"2026-11-03T02:21:50.339607Z"}],"ghsa":[{"id":"GHSA-5746-cvmj-7x62","title":"Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update...","description":"Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233.","status":"published","published":"2022-05-17T00:25:39Z","modified":"2023-02-03T05:01:41Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:53:01.625617Z"}],"nvd":[{"id":"CVE-2015-7943","description":"Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233.","status":"published","published":"2017-10-18T18:29:00.33Z","modified":"2026-06-17T00:33:25.957Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:03:19.244941Z"}],"osv":[{"id":"UBUNTU-CVE-2015-7943","description":"Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233.","status":"published","published":"2017-10-18T18:29:00Z","modified":"2025-09-08T16:43:29Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.737723Z"},{"id":"DLA-548-1","title":"drupal7 - security update","status":"published","published":"2016-07-11T00:00:00Z","modified":"2026-03-09T02:09:16.892299Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2015-0425","title":"Updated drupal package fixes security vulnerability","description":"The Overlay module in Drupal core displays administrative pages as a layer\nover the current page (using JavaScript), rather than replacing the page\nin the browser window. The Overlay module does not sufficiently validate\nURLs prior to displaying their contents, leading to an open redirect\nvulnerability (CVE-2015-7943).\n","status":"published","published":"2015-11-04T18:03:05Z","modified":"2026-04-16T06:26:08.595260004Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}