CVE-2016-3167 Drupal Open redirect vulnerability in the drupal_goto function
Remote attackers can redirect users to arbitrary sites via double-encoded URLs in Drupal 6.x, facilitating phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-3167?
CVE-2016-3167 is a high-severity vulnerability in Debian Debian Linux, published on 12 Apr 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a double-encoded URL in the "destination" parameter.
Which versions are affected by CVE-2016-3167?
4 open source packages ship an affected version, including drupal/core and drupal/drupal. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
drupal/core Packagist | From 6.0 | 6.38 |
drupal/core Packagist | From 6.0 | 6.38 |
drupal/drupal Packagist | From 6.0 | 6.38 |
drupal/drupal Packagist | From 6.0 | 6.38 |
Products include Debian Debian Linux, Drupal Drupal.
How do I fix CVE-2016-3167?
Upgrade drupal/core to 6.38 or later.
Is CVE-2016-3167 being exploited?
There is no known exploitation of CVE-2016-3167 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as GHSA-gxwx-c7m8-f95h.