GHSA-6gf6-24h2-66j4
GHSA-6gf6-24h2-66j4 · Drupal core Open Redirect vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. The vulnerability is caused by insufficient validation of the destination query parameter in the drupal_goto() function. Other versions of Drupal core are not vulnerable.
CVSS 4.3 · Medium · Fix available
- Published
- Updated
Stack: php
Affected products and versions
drupal/core Packagist
- Affected ranges
- ECOSYSTEM: ≥ 7.0.0, < 7.70
Update to 7.70