Fluid Attacks Database

Description

Drupal Open Redirect Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	drupal/core	>=8.0 <8.0.4 \|\| >=7.0 <7.43 \|\| >=6.0 <6.38	8.0.4, 7.43, 6.38
packagist	drupal/drupal	>=6.0 <6.38 \|\| >=7.0 <7.43 \|\| >=8.0 <8.0.4	6.38, 7.43, 8.0.4

Aliases

1. CVE-2016-31642. NVD-2016-31643. OSV-2016-31644. GCVE-2016-3164

References

1. https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3164.yaml2. https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3164.yaml3. https://www.drupal.org/SA-CORE-2016-0014. http://www.debian.org/security/2016/dsa-34985. http://www.openwall.com/lists/oss-security/2016/02/24/196. http://www.openwall.com/lists/oss-security/2016/03/15/10

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.