medium4.7
CVE-2017-6932
Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used.
Impact
Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an external site.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Drupal | Drupal | from 7.0 before 7.57 |
| Debian | Debian Linux | Versions 7.0, 8.0, 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html
- https://www.debian.org/security/2018/dsa-4123
- https://www.drupal.org/sa-core-2018-001
- https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html
- https://www.debian.org/security/2018/dsa-4123
- https://www.drupal.org/sa-core-2018-001