GitHub Advisoryadvisory · Packagist

GHSA-wxfg-253g-m7r4 Drupal core Open Redirect vulnerability

MEDIUM Published 2024-05-15 Modified 2024-05-15 Official page ↗
Ecosystem
Packagist
Packages
drupal/drupal
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-601
Reviewed
2024-05-15

Affected packages

• Packagist drupal/drupal: >= 7.0.0, < 7.70 → fixed in 7.70

Description

Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. The vulnerability is caused by insufficient validation of the destination query parameter in the drupal_goto() function. Other versions of Drupal core are not vulnerable.

Related

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References