Vulnerability advisory

GHSA-836p-6p4j-35cg

Drupal Open Redirect

Published May 17, 2022Updated Dec 3, 2024OSV record ↗

Also known as CVE-2016-3164

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Affected versions

drupal/drupal Packagist

All drupal/drupal advisories →

Affected	Fixed in
`6.0` to before 6.38	`6.38`Advisories →
`7.0` to before 7.43	`7.43`Advisories →
`8.0` to before 8.0.4	`8.0.4`Advisories →
Also listed as affected (25) `8.0.0` `8.0.0-alpha14` `8.0.0-alpha15` `8.0.0-beta1` `8.0.0-beta10` `8.0.0-beta11` `8.0.0-beta12` `8.0.0-beta13` `8.0.0-beta14` `8.0.0-beta15` `8.0.0-beta16` `8.0.0-beta2` `8.0.0-beta3` `8.0.0-beta4` `8.0.0-beta5` `8.0.0-beta6` `8.0.0-beta7` `8.0.0-beta9` `8.0.0-rc1` `8.0.0-rc2` `8.0.0-rc3` `8.0.0-rc4` `8.0.1` `8.0.2` `8.0.3`

drupal/core Packagist

All drupal/core advisories →

Affected	Fixed in
`8.0` to before 8.0.4	`8.0.4`Advisories →
Also listed as affected (19) `8.0.0` `8.0.0-beta10` `8.0.0-beta11` `8.0.0-beta12` `8.0.0-beta13` `8.0.0-beta14` `8.0.0-beta15` `8.0.0-beta16` `8.0.0-beta6` `8.0.0-beta7` `8.0.0-beta8` `8.0.0-beta9` `8.0.0-rc1` `8.0.0-rc2` `8.0.0-rc3` `8.0.0-rc4` `8.0.1` `8.0.2` `8.0.3`
`7.0` to before 7.43	`7.43`Advisories →
`6.0` to before 6.38	`6.38`Advisories →

Description

Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.

GHSA-836p-6p4j-35cg

Affected versions

drupal/drupal Packagist

drupal/core Packagist

Description

References