CVE-2020-13662 Drupal Core Open Redirect vulnerability
Attackers can trick users into visiting malicious external links via crafted URLs in Drupal Core, potentially facilitating phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-13662?
CVE-2020-13662 is a medium-severity vulnerability in Drupal Drupal, published on 5 May 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions.
Weakness: CWE-601
Which versions are affected by CVE-2020-13662?
5 open source packages ship an affected version, including drupal/core, drupal and drupal/drupal. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
drupal/core Packagist | From 7.0.0 | 7.70 |
drupal/core Packagist | From 7.0.0 | 7.70 |
drupal Bitnami | From 7.0.0 | 7.70.1 |
drupal/drupal Packagist | From 7.0.0 | 7.70 |
drupal/drupal Packagist | From 7.0.0 | 7.70 |
Products include Drupal Drupal.
How do I fix CVE-2020-13662?
Upgrade drupal/core to 7.70 or later.
Is CVE-2020-13662 being exploited?
There is no known exploitation of CVE-2020-13662 in the wild and no public exploit code.
Other vulnerabilities in Drupal Drupal
Sources
Also known as BIT-drupal-2020-13662, CLEANSTART-2024-OJ63880, DLA-2250-1, GHSA-gjqg-9rhv-qj67, UBUNTU-CVE-2020-13662.