Vulnerability advisory

CVE-2016-9451

Published Nov 25, 2016Updated Oct 24, 2026OSV record ↗

Severity

Affected versions

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
497914920385b7016ac9c9367e0198530787adf2 through ce174ee8bf12440b904c0cbdb9c5a01bdc1784c4	No fix listed
Also listed as affected (55) `7.0` `7.0-alpha1` `7.0-alpha2` `7.0-alpha3` `7.0-alpha4` `7.0-alpha5` `7.0-alpha6` `7.0-alpha7` `7.0-beta1` `7.0-beta2` `7.0-beta3` `7.1` `7.10` `7.11` `7.12` `7.13` `7.14` `7.15` `7.16` `7.17` `7.18` `7.19` `7.2` `7.20` `7.21` `7.22` `7.23` `7.24` `7.25` `7.26` `7.27` `7.28` `7.29` `7.3` `7.30` `7.31` `7.32` `7.33` `7.34` `7.35` `7.36` `7.37` `7.38` `7.4` `7.40` `7.41` `7.42` `7.43` `7.44` `7.50` `7.51` `7.9` `7.8` `7.7` `7.6`

Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.