CVE-2016-9451: Drupal Open Redirect
Summary
CVE-2016-9451: Drupal Open Redirect. Affects drupal/core across 2 version ranges.
>= 7.0, < 7.52
>= 8.0, < 8.2.3
Fixed in 7.52 or 8.2.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The Drupal core package is vulnerable to an open redirect attack in confirmation forms. This vulnerability affects Drupal versions 7.x before 7.52 and versions 8.0 to 8.2.2. An open redirect vulnerability allows remote authenticated users to manipulate URLs and redirect users to malicious websites or phishing pages.
Vulnerability Detail
The confirmation forms in Drupal 7.x before 7.52 and versions 8.0 to 8.2.2 are susceptible to open redirect attacks. This vulnerability enables remote authenticated users to exploit unspecified vectors and conduct open redirect attacks. By manipulating certain parameters in the confirmation forms, attackers can trick users into visiting malicious websites or disclosing sensitive information. The impact of this vulnerability can range from unauthorized access to sensitive data to potential phishing attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0, < 7.527.52composer require drupal/core:7.52 -
>= 8.0, < 8.2.38.2.3composer require drupal/core:8.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of Drupal.
Conclusion
The Drupal core package is vulnerable to an open redirect attack in confirmation forms. Upgrading to the latest version of Drupal (7.52 or later for Drupal 7.x, and 8.2.3 or later for Drupal 8.x) is necessary to fix this vulnerability. It is important to stay updated with security patches to protect against potential attacks. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
An open redirect vulnerability allows attackers to manipulate URLs and redirect users to malicious websites or phishing pages.
This vulnerability affects Drupal versions 7.x before 7.52 and versions 8.0 to 8.2.2.
The impact of this vulnerability can range from unauthorized access to sensitive data to potential phishing attacks.
To fix this vulnerability, it is recommended to upgrade to the latest version of Drupal (7.52 or later for Drupal 7.x, and 8.2.3 or later for Drupal 8.x).
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the latest version of Drupal.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
