View online: https://www.drupal.org/sa-core-2020-003
Project: Drupal core [1] Date: 2020-May-20 Security risk: *Moderately critical* 10∕25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Open Redirect
Description: Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL.
The vulnerability is caused by insufficient validation of the destination query parameter in the drupal_goto() function.
Other versions of Drupal core are not vulnerable.
Solution: Install the latest version:
* If you use Drupal 7.x upgrade to Drupal 7.70 [3]
Reported By: * vortfu [4]
Fixed By: * Drew Webber [5] of the Drupal Security Team * Fabian Franz [6] * David Snopek [7] of the Drupal Security Team * vortfu [8]
[1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/7.70 [4] https://www.drupal.org/user/3638636 [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/693738 [7] https://www.drupal.org/user/266527 [8] https://www.drupal.org/user/3638636