SA-CONTRIB-2015-034 - Commerce WeDeal - Open Redirect

Commerce WeDeal module enables you to do Commerce payments through the payment provider WeDeal.

The module doesn’t sufficiently check a query parameter used for page redirection, thereby leading to an Open Redirect vulnerability.

CVE identifier(s) issued

• CVE-2015-3393

Versions affected

• Commerce WeDeal 7.x-1.x versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed Commerce WeDeal module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the Commerce WeDeal module for Drupal 7.x, upgrade to Commerce WeDeal 7.x-1.3

Also see the Commerce WeDeal project page.

Reported by

• Pere Orga of the Drupal Security Team

Fixed by

• Jeroen Bobbeldijk the module maintainer

Coordinated by

• Pere Orga of the Drupal Security Team