[Security-news] Drupal core - Moderately critical - Open Redirect - SA-CORE-2020-003

[security-news at drupal.org]

View online: https://www.drupal.org/sa-core-2020-003

Project: Drupal core [1]
Date: 2020-May-20
Security risk: *Moderately critical* 10∕25
AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2]
Vulnerability: Open Redirect

Description: 
Drupal 7 has an Open Redirect vulnerability. For example, a user could be
tricked into visiting a specially crafted link which would redirect them to
an arbitrary external URL.

The vulnerability is caused by insufficient validation of the destination
query parameter in the drupal_goto() function.

Other versions of Drupal core are not vulnerable.

Solution: 
Install the latest version:

   * If you use Drupal 7.x upgrade to Drupal 7.70 [3]

Reported By: 
   * vortfu  [4]

Fixed By: 
   * Drew Webber  [5] of the Drupal Security Team
   * Fabian Franz  [6]
   * David Snopek  [7] of the Drupal Security Team
   * vortfu  [8]


[1] https://www.drupal.org/project/drupal
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/drupal/releases/7.70
[4] https://www.drupal.org/user/3638636
[5] https://www.drupal.org/user/255969
[6] https://www.drupal.org/user/693738
[7] https://www.drupal.org/user/266527
[8] https://www.drupal.org/user/3638636