Vulnerability advisory
GHSA-wxfg-253g-m7r4
Drupal core Open Redirect vulnerability
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected versions
| Affected | Fixed in |
|---|---|
7.0.0 to before 7.70 | 7.70Advisories → |
Description
Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL.
The vulnerability is caused by insufficient validation of the destination query parameter in the drupal_goto() function.
Other versions of Drupal core are not vulnerable.