CVE-2017-6932

MEDIUM

Drupal 7.x < 7.57 - Open Redirect via Language Switcher Block

Title source: llm
STIX 2.1

Description

Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an external site.

References (3)

Core 3
Core References
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4123
Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html
Vendor Advisory x_refsource_confirm
https://www.drupal.org/sa-core-2018-001

Scores

CVSS v3 4.7
EPSS 0.0038
EPSS Percentile 59.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-601
Status published
Products (6)
debian/debian_linux 7.0
debian/debian_linux 8.0
debian/debian_linux 9.0
drupal/core 7.0 - 7.57Packagist
drupal/drupal 7.0 - 7.57
drupal/drupal 7.0 - 7.57Packagist
Published Mar 01, 2018
Tracked Since Feb 18, 2026