Vulnerability advisory

CVE-2016-3164

Published Apr 12, 2016Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
f8d6bbf44160e6d00e71f0172ecf80e78d0f0d3c through 3f7404935955cd2a63023e77a07c4231ad5ff62a	No fix listed
Also listed as affected (114) `6.0` `6.1` `6.10` `6.11` `6.12` `6.13` `6.14` `6.15` `6.16` `6.17` `6.18` `6.19` `6.2` `6.20` `6.21` `6.22` `6.23` `6.24` `6.25` `6.26` `6.27` `6.28` `6.29` `6.3` `6.30` `6.31` `6.32` `6.33` `6.34` `6.35` `6.36` `6.37` `6.4` `6.5` `6.6` `6.7` `6.8` `6.9` `7.0` `7.0-alpha1` `7.0-alpha2` `7.0-alpha3` `7.0-alpha4` `7.0-alpha5` `7.0-alpha6` `7.0-alpha7` `7.0-beta1` `7.0-beta2` `7.0-beta3` `7.1` `7.10` `7.11` `7.12` `7.13` `7.14` `7.15` `7.16` `7.17` `7.18` `7.19` `7.2` `7.20` `7.21` `7.22` `7.23` `7.24` `7.25` `7.26` `7.27` `7.28` `7.29` `7.3` `7.30` `7.31` `7.32` `7.33` `7.34` `7.35` `7.36` `7.37` `7.38` `7.4` `7.40` `7.41` `7.42` `7.5` `7.6` `7.7` `7.8` `7.9` `8.0.0` `8.0.0-alpha14` `8.0.0-alpha15` `8.0.0-beta1` `8.0.0-beta10` `8.0.0-beta11` `8.0.0-beta12` `8.0.0-beta13` `8.0.0-beta14` `8.0.0-beta15` `8.0.0-beta16` `8.0.0-beta2` `8.0.0-beta3` `8.0.0-beta4` `8.0.0-beta6` `8.0.0-beta7` `8.0.0-beta9` `8.0.0-rc1` `8.0.0-rc2` `8.0.0-rc3` `8.0.0-rc4` `8.0.1` `8.0.2` `8.0.3`

Description

Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.

CVE-2016-3164

Affected versions

Repository

Description

References