p PatchFirst

CVE-2017-6932

CVE-2017-6932

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an external site.

CVSS 4.7 · Medium · EPSS 1.2% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • drupal core

    Versions
    • 7.x versions before 7.57: Affected

    No fix published

  • drupal/core Packagist

    Affected ranges
    • ECOSYSTEM: ≥ 7.0, < 7.57

    Update to 7.57

  • drupal/drupal Packagist

    Affected ranges
    • ECOSYSTEM: ≥ 7.0, < 7.57

    Update to 7.57

  • drupal7 Ubuntu:Pro:14.04:LTS

    Versions
    • 7.23-1
    • 7.24-1
    • 7.24-2
    • 7.26-1
    • 7.26-1ubuntu0.1
    • 7.26-1ubuntu0.1+esm1
    • 7.26-1ubuntu0.1+esm2
    • 7.26-1ubuntu0.1+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • drupal7 Ubuntu:Pro:16.04:LTS

    Versions
    • 7.38-1
    • 7.41-1
    • 7.44-1ubuntu1~16.04.0
    • 7.44-1ubuntu1~16.04.0+esm1
    • 7.44-1ubuntu1~16.04.0+esm2
    • 7.44-1ubuntu1~16.04.0+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →