Vulnerability advisory

GHSA-66gr-xrcf-8jpq

Drupal Open Redirect

Published May 17, 2022Updated Apr 23, 2024OSV record ↗

Also known as CVE-2016-9451

Severity

Affected versions

Affected	Fixed in
`7.0` to before 7.52	`7.52`Advisories →
`8.0` to before 8.2.3	`8.2.3`Advisories →
Also listed as affected (44) `8.0.0` `8.0.0-beta10` `8.0.0-beta11` `8.0.0-beta12` `8.0.0-beta13` `8.0.0-beta14` `8.0.0-beta15` `8.0.0-beta16` `8.0.0-beta6` `8.0.0-beta7` `8.0.0-beta8` `8.0.0-beta9` `8.0.0-rc1` `8.0.0-rc2` `8.0.0-rc3` `8.0.0-rc4` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.10` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9` `8.2.0` `8.2.0-beta1` `8.2.0-beta2` `8.2.0-beta3` `8.2.0-rc1` `8.2.0-rc2` `8.2.1` `8.2.2`

Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.