GHSA-6gf6-24h2-66j4 Drupal core Open Redirect vulnerability
An attacker can trick users into visiting a crafted link that redirects them to an arbitrary external URL via insufficient validation in Drupal core.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-6gf6-24h2-66j4?
GHSA-6gf6-24h2-66j4 is a vulnerability in drupal/core, published on 15 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL.
The vulnerability is caused by insufficient validation of the destination query parameter in the drupal_goto() function.
Other versions of Drupal core are not vulnerable.
Which versions are affected by GHSA-6gf6-24h2-66j4?
2 open source packages ship an affected version, including drupal/core.
| Package | Affected | Fixed in |
|---|---|---|
drupal/core Packagist | From 7.0.0 | 7.70 |
drupal/core Packagist | From 7.0.0 | 7.70 |
How do I fix GHSA-6gf6-24h2-66j4?
Upgrade drupal/core to 7.70 or later.
Is GHSA-6gf6-24h2-66j4 being exploited?
There is no known exploitation of GHSA-6gf6-24h2-66j4 in the wild and no public exploit code.