CVE-2016-3167: Open redirect via double-encoded 'destination' parameter
Open redirect via double-encoded 'destination' parameter
Other sources
Open redirect vulnerability in the drupalgoto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a double-encoded URL in the "destination" parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 6.38 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 6.38 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.0.4 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 8.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3167?
CVE-2016-3167 is rated as a medium severity vulnerability due to its potential to facilitate phishing attacks.
How do I fix CVE-2016-3167?
To fix CVE-2016-3167, upgrade your Drupal installation to version 6.38 or later.
Which versions of Drupal are affected by CVE-2016-3167?
CVE-2016-3167 affects Drupal versions prior to 6.38.
Can CVE-2016-3167 lead to unauthorized access?
Yes, CVE-2016-3167 can potentially lead to unauthorized access by redirecting users to malicious sites.
What components are impacted by CVE-2016-3167?
CVE-2016-3167 impacts the drupal_goto function in the affected versions of Drupal.