SA-CONTRIB-2015-019 - Ubercart Currency Conversion - Open Redirect

This module enables users to change the currency of Ubercart products.

When switching the currency, the user is redirected to a page specified in the destination query parameter. The module was not checking that the passed argument was an internal URL, thereby leading to an open redirect vulnerability.

CVE identifier(s) issued

• CVE-2015-3342

Versions affected

• Ubercart Currency Conversion 6.x-1.x versions prior to 6.x-1.2

Drupal core is not affected. If you do not use the contributed Ubercart Currency Conversion module, there is nothing you need to do.

Solution

• If you use the Ubercart Currency Conversion module for Drupal 6.x, upgrade to Ubercart Currency Conversion 6.x-1.2

Also see the Ubercart Currency Conversion project page.

Reported by

• Pere Orga provisional member of the Drupal Security Team

Fixed by

• Sudhir Krishna S the module maintainer

Coordinated by

• Pere Orga provisional member of the Drupal Security Team