PT-2024-40299 · Drupal · Drupal Core

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal core (affected versions not specified)

Description The issue allows malicious users to construct a URL that tricks users into being redirected to a 3rd party website, exposing them to potential social engineering attacks. This is possible due to the way Drupal core and contributed modules use a destination query string parameter in URLs to redirect users after completing an action.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

GHSA-GFVF-2F25-F34R

Affected Products

Drupal Core

References · 4

• https://osv.dev/vulnerability/GHSA-gfvf-2f25-f34r · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2018-10-17-3.yaml · Note
• https://github.com/drupal/core · Note
• https://drupal.org/sa-core-2018-006 · Note