high7.4
CVE-2016-3164
Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2…
Impact
Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Drupal | Drupal | Versions 6.0, 6.1, 6.2, 6.3, 6.4, 6.5 |
| Debian | Debian Linux | Versions 7.0, 8.0 |
References
- NVD record
- CVE.org record
- http://www.debian.org/security/2016/dsa-3498
- http://www.openwall.com/lists/oss-security/2016/02/24/19
- http://www.openwall.com/lists/oss-security/2016/03/15/10
- https://www.drupal.org/SA-CORE-2016-001
- http://www.debian.org/security/2016/dsa-3498
- http://www.openwall.com/lists/oss-security/2016/02/24/19
- http://www.openwall.com/lists/oss-security/2016/03/15/10
- https://www.drupal.org/SA-CORE-2016-001