CVE-2013-4595: The Secure Pages module 6.x-2.x before 6.x-2.0 for Drupal does not properly match URLs, which causes HTTP t...

Security readout for executives and security teams

This flaw affects Drupal sites using the Secure Pages module 6.x-2.x before 6.x-2.0. The module may fail to match protected URLs correctly, so pages intended for HTTPS can be served over HTTP. That can expose sensitive traffic to interception if users access affected pages over insecure networks. Exposure is likely limited to legacy Drupal 6 deployments running Secure Pages 6.x-2.x before 6.x-2.0. Sites not using this contributed module, or already on 6.x-2.0 or later, are not indicated as affected by the provided sources. Treat this as a targeted legacy-web risk. It is not sourced as actively exploited, but it can undermine confidentiality on older Drupal sites handling logins, forms, or account data. Prioritize internet-facing or sensitive-data systems first. Mitigation focus: Upgrade Secure Pages to 6.x-2.0 or later where the Drupal module remains in use.; Review Drupal advisory guidance before changing legacy production systems.; Enforce HTTPS for sensitive routes at the web server, CDN, or platform layer where feasible..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.