CVE-2016-3167

HIGH

Drupal 6.x < 6.38 - Open Redirect via Double-Encoded Destination Parameter

Title source: llm

Description

Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a double-encoded URL in the "destination" parameter.

References (4)

Core 4

Core References

Mailing List mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/02/24/19

Mailing List mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/03/15/10

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3498

Patch, Vendor Advisory x_refsource_confirm

https://www.drupal.org/SA-CORE-2016-001

Scores

CVSS v3 7.4

EPSS 0.0063

EPSS Percentile 70.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Details

Status published

Products (42)

debian/debian_linux 7.0

debian/debian_linux 8.0

drupal/core 6.0 - 6.38Packagist

drupal/drupal 6.0 beta2 (8 CPE variants)

drupal/drupal 6.1

drupal/drupal 6.2

drupal/drupal 6.3

drupal/drupal 6.4

drupal/drupal 6.5

drupal/drupal 6.6

... and 32 more

Published Apr 12, 2016

Tracked Since Feb 18, 2026