GitHub Advisoryadvisory · Packagist
GHSA-836p-6p4j-35cg Drupal Open Redirect
HIGH
Official page ↗
- Aliases
- CVE-2016-3164
- Ecosystem
- Packagist
- Packages
- drupal/drupal, drupal/core
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
- Reviewed
- 2023-07-31
Affected packages
• Packagist drupal/drupal: >= 6.0, < 6.38 → fixed in 6.38
• Packagist drupal/drupal: >= 7.0, < 7.43 → fixed in 7.43
• Packagist drupal/drupal: >= 8.0, < 8.0.4 → fixed in 8.0.4
• Packagist drupal/core: >= 8.0, < 8.0.4 → fixed in 8.0.4
• Packagist drupal/core: >= 7.0, < 7.43 → fixed in 7.43
• Packagist drupal/core: >= 6.0, < 6.38 → fixed in 6.38
Description
Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.
Related
Alias · CVE (1)
- CVE-2016-3164 Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-3164 advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3164.yaml web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3164.yaml web
- https://github.com/drupal/drupal package
- https://www.drupal.org/SA-CORE-2016-001 web
- http://www.debian.org/security/2016/dsa-3498 web
- http://www.openwall.com/lists/oss-security/2016/02/24/19 web
- http://www.openwall.com/lists/oss-security/2016/03/15/10 web