• Advisory ID: DRUPAL-SA-CONTRIB-2012-118
  • Project: Secure Login (third-party module)
  • Version: 7.x
  • Date: 2012-July-25
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: Open Redirect


Secure Login module enables the user login and other forms to be submitted securely via HTTPS, thus preventing passwords and other private user data from being transmitted in clear text. In addition, Secure Login module by default redirects non-HTTPS GET requests for pages containing forms that it secures to the HTTPS site.

The module does not sufficiently validate that a requested path is internal to the site, allowing an attacker to disguise a malicious destination address as a GET query parameter passed to a non-HTTPS site URL.

This vulnerability is mitigated by the fact that the target site must render a form secured by Secure Login module on its 404 page, such as in a block. A default installation of Drupal 7 renders the user login block on the 404 page, and is thus vulnerable to the open redirect.

CVE: Requested

Versions affected

  • Secure Login 7.x-1.x versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed Secure Login module, there is nothing you need to do.


Install the latest version:

Also see the Secure Login project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.