Your submission was sent successfully! Close

CVE-2016-3167

Published: 12 April 2016

Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a double-encoded URL in the "destination" parameter.

Priority

Unknown

CVSS 3 base score: 7.4

Status

Package Release Status
drupal6
Launchpad, Ubuntu, Debian
precise Does not exist
(precise was needed)
trusty Does not exist

upstream
Released (6.38)
wily Does not exist

xenial Does not exist

yakkety Does not exist

zesty Does not exist

drupal7
Launchpad, Ubuntu, Debian
precise Does not exist
(precise was not-affected)
trusty Does not exist
(trusty was not-affected)
upstream Not vulnerable

wily Not vulnerable

xenial Not vulnerable

yakkety Not vulnerable

zesty Not vulnerable