Unscored severity · published Jun 16, 2015
CVE-2015-4398
Open redirect vulnerability in the Chaos tool suite (ctools) module before 6.x-1.12 and 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to redirect users to arbitrary…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Open redirect vulnerability in the Chaos tool suite (ctools) module before 6.x-1.12 and 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors involving processing confirmation delete pages.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CT
Ctools · Chaos Tool Suite Project
through 6.x-1.11; 7.x-1.0; 7.x-1.1; 7.x-1.2; 7.x-1.3; 7.x-1.4; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-4398
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-4398
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/03/22/35
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/04/25/6
www.securityfocus.com
http://www.securityfocus.com/bid/73224
Patch
https://www.drupal.org/node/2454883
Patch
https://www.drupal.org/node/2454885
Patch
https://www.drupal.org/node/2454909
More from Ctools
7.5
CVE-2015-7875
ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on Panels and similar…
–
CVE-2015-6665
Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject…
–
CVE-2015-4375
The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an autocomplete search on custom entities…
–
CVE-2013-1925
The Chaos Tool Suite (ctools) module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict node access, which allows remote authenticated users with the "access content"…
–
CVE-2012-5559
Cross-site scripting (XSS) vulnerability in the page manager node view task in the Chaos tool suite (ctools) module 6.x-1.x before 6.x-1.10 for Drupal allows remote authenticated…