GHSA-6gf6-24h2-66j4: Drupal core Open Redirect vulnerability

May 15, 2024

Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL.

The vulnerability is caused by insufficient validation of the destination query parameter in the drupal_goto() function.

Other versions of Drupal core are not vulnerable.

References

github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2020-05-20-1.yaml
github.com/advisories/GHSA-6gf6-24h2-66j4
github.com/drupal/core
www.drupal.org/sa-core-2020-003

Code Behaviors & Features

Detect and mitigate GHSA-6gf6-24h2-66j4 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →