CVE-2020-13662: Open Redirect vulnerability in Drupal Core
Summary
CVE-2020-13662: Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. Affects drupal versions >= 7.0.0, < 7.70.1. Fixed in 7.70.1. How to fix ↓
Also tracked for
- drupal/core · Packagist
The same CVE-2020-13662 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The vulnerability identified as CVE-2020-13662 affects Drupal Core version 7.70 and prior versions. Drupal Core is the main software package that includes the essential functionality of Drupal. This vulnerability allows an attacker to trick a user into visiting a specially crafted link, which then redirects them to an arbitrary external URL.
Vulnerability Detail
The Open Redirect vulnerability in Drupal Core arises from a failure to properly validate user-supplied input. By exploiting this vulnerability, an attacker can create a malicious link that appears legitimate to the user. When the user clicks on the link, they are redirected to an external website chosen by the attacker. This can lead to various malicious activities, such as phishing attacks, where the user is tricked into providing sensitive information on a fake website. The severity of this vulnerability is rated as Medium with a CVSS score of 3.1.
How To Fix
Minimum fixed version
7.70.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security patch provided by Drupal to mitigate the risk.
Conclusion
The Open Redirect vulnerability in Drupal Core can be mitigated by updating to the latest version of Drupal Core and educating users about the risks associated with clicking on suspicious links. It is crucial to apply the provided security patch to ensure the security of your Drupal installation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal →
FAQ
Drupal Core is the main software package that provides the essential functionality of Drupal. It includes features such as content management, user authentication, and site administration.
The Open Redirect vulnerability in Drupal Core allows an attacker to create a malicious link that appears legitimate. When a user clicks on the link, they are redirected to an external website chosen by the attacker.
This vulnerability can be exploited for various malicious activities, including phishing attacks. Users may be tricked into providing sensitive information on a fake website.
The severity of this vulnerability is rated as Medium with a CVSS score of 3.1.
To protect your Drupal installation, it is crucial to update Drupal Core to version 7.70 or later. Additionally, educate users about the risks of clicking on suspicious links and encourage them to verify the legitimacy of URLs before visiting them.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal.
