SA-CONTRIB-2015-055 - Services single sign-on server helper - Open Redirect - Unsupported

Services single sign-on server helper module provides functionality to facilitate account information editing on a remote SSO site.

The module doesn’t validate some user supplied URLs in parameters used for page redirection. An attacker could trick users to visit malicious sites without realizing it.

CVE identifier(s) issued

• CVE-2015-2215

Versions affected

All versions of Services single sign-on server helper module.

Drupal core is not affected. If you do not use the contributed Services single sign-on server helper module, there is nothing you need to do.

Solution

If you use the Services single sign-on server helper module you should uninstall it.

Also see the Services single sign-on server helper project page.

Reported by

• Pere Orga of the Drupal Security Team

Fixed by

Not applicable.

Coordinated by

• Pere Orga of the Drupal Security Team