CVE-2015-4371: Open redirect vulnerability in the Perfecto module before 7.x-1.2 for Drupal allows remote attackers to red...

Security readout for executives and security teams

This issue affects the Drupal Perfecto contributed module before 7.x-1.2. A remote attacker could abuse an open redirect to send users from a trusted Drupal site to an arbitrary external site, supporting phishing. The bundle does not provide CVSS, CWE, or evidence of active exploitation. Exposure is likely limited to Drupal sites that installed the Perfecto contributed module and have not updated beyond versions before 7.x-1.2. Treat this as a targeted phishing risk, not a server takeover based on the available evidence. Patch exposed Drupal sites using Perfecto, especially public sites users trust for login or account workflows. Mitigation focus: Upgrade the Drupal Perfecto module to version 7.x-1.2 or later.; Check the Drupal advisory for any vendor-specific remediation notes.; Disable or remove the Perfecto module if it is not needed..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.