GHSA-wxfg-253g-m7r4 Drupal core Open Redirect vulnerability
An attacker can trick users into visiting a crafted link that redirects them to an arbitrary external URL via insufficient validation in Drupal core.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-wxfg-253g-m7r4?
GHSA-wxfg-253g-m7r4 is a vulnerability in drupal/drupal, published on 15 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL.
The vulnerability is caused by insufficient validation of the destination query parameter in the drupal_goto() function.
Other versions of Drupal core are not vulnerable.
Which versions are affected by GHSA-wxfg-253g-m7r4?
2 open source packages ship an affected version, including drupal/drupal.
| Package | Affected | Fixed in |
|---|---|---|
drupal/drupal Packagist | From 7.0.0 | 7.70 |
drupal/drupal Packagist | From 7.0.0 | 7.70 |
How do I fix GHSA-wxfg-253g-m7r4?
Upgrade drupal/drupal to 7.70 or later.
Is GHSA-wxfg-253g-m7r4 being exploited?
There is no known exploitation of GHSA-wxfg-253g-m7r4 in the wild and no public exploit code.