CVE-2020-13662: Drupal Core Open Redirect vulnerability
Summary
CVE-2020-13662: Drupal Core Open Redirect vulnerability. Affects drupal/core versions >= 7.0.0, < 7.70. Fixed in 7.70. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2020-13662 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Core is an open-source content management system (CMS) used to build and manage websites. It provides a flexible framework for creating and organizing content, as well as various modules and themes for customization. The vulnerability in question, CVE-2020-13662, is an Open Redirect vulnerability that affects Drupal Core versions 7.70 and earlier. This vulnerability allows an attacker to trick a user into visiting a specially crafted link, which then redirects them to an arbitrary external URL.
Vulnerability Detail
The Open Redirect vulnerability in Drupal Core arises from a failure to properly validate and sanitize user-supplied input. By exploiting this vulnerability, an attacker can craft a malicious URL that appears legitimate to the user, but actually redirects them to a different website. This can be used for various malicious purposes, such as phishing attacks or spreading malware. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.1.
How To Fix
Minimum fixed version
7.70
This is the first release that contains the fix.
composer require drupal/core:7.70Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to the latest version of Drupal Core.
Conclusion
The Open Redirect vulnerability in Drupal Core can be mitigated by updating to version 7.70 or later. It is crucial for Drupal users to promptly apply the provided patch or upgrade their installations to ensure protection against potential attacks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
An Open Redirect vulnerability allows an attacker to redirect a user to an arbitrary external URL by tricking them into clicking on a specially crafted link.
This vulnerability can be exploited for phishing attacks, spreading malware, or redirecting users to malicious websites.
Drupal Core versions 7.70 and earlier are affected by this vulnerability.
Yes, the Drupal security team has released a patch to fix this vulnerability. Users should update their Drupal installations to the latest version.
No, there is no known workaround. It is crucial to apply the official patch or upgrade to the latest version of Drupal Core.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
