CVE-2016-3164: Open redirect via path manipulation
Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 6.38 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 7.43 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.0.4 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 8.0.4 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 7.43 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 6.38
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3164?
CVE-2016-3164 has a medium severity level due to its potential for exploitation through open redirect attacks.
How do I fix CVE-2016-3164?
To mitigate CVE-2016-3164, update your Drupal installation to version 6.38, 7.43, or 8.0.4 or later.
Which Drupal versions are affected by CVE-2016-3164?
CVE-2016-3164 affects Drupal versions prior to 6.38, 7.43, and 8.0.4.
Is CVE-2016-3164 easy to exploit?
Yes, exploiting CVE-2016-3164 is relatively straightforward as it involves open redirect functionality.
What types of attacks can CVE-2016-3164 enable?
CVE-2016-3164 can allow remote attackers to conduct open redirect attacks, potentially leading to phishing or redirection to malicious sites.