CVE-2017-6932: Medium severity drupal vulnerability
Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an external site.
Other sources
External link injection on 404 pages when linking to the current page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6932?
CVE-2017-6932 is considered a moderate severity vulnerability due to its potential to mislead users into clicking on external links.
How do I fix CVE-2017-6932?
To fix CVE-2017-6932, upgrade Drupal core to version 7.57 or later.
What versions of Drupal are affected by CVE-2017-6932?
CVE-2017-6932 affects Drupal core versions before 7.57 including all versions from 7.0 to 7.56.
What type of vulnerability is CVE-2017-6932?
CVE-2017-6932 is classified as an external link injection vulnerability.
Can custom modules be affected by CVE-2017-6932?
Yes, CVE-2017-6932 may also affect various custom and contributed Drupal modules that utilize the language switcher block.