CVE-2016-9451: Drupal Open Redirect
Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.2.3 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 7.52
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9451?
CVE-2016-9451 is rated as moderate severity due to its potential for open redirect attacks.
How do I fix CVE-2016-9451?
To fix CVE-2016-9451, update Drupal to version 7.52 or later.
Who is affected by CVE-2016-9451?
Remote authenticated users on Drupal 7.x versions prior to 7.52 are affected by CVE-2016-9451.
What kind of attack can CVE-2016-9451 facilitate?
CVE-2016-9451 can facilitate open redirect attacks, allowing attackers to redirect users to unauthorized locations.
When was CVE-2016-9451 disclosed?
CVE-2016-9451 was disclosed in November 2016.