In certain circumstances the user could enter a particular path that triggered an open redirect to a malicious URL.
While this issue was mitigated by the fact that the user needed the administer paths permission to exploit,
the path module has been patched to prevent malicious usage.
Part of security release SA-CORE-2018-006
This vulnerability affects the following application versions:
- Drupal 7.0
- Drupal 7.1
- Drupal 7.2
- Drupal 7.3
- Drupal 7.4
- Drupal 7.5
- Drupal 7.6
- Drupal 7.7
- Drupal 7.8
- Drupal 7.9
- Drupal 7.10
- Drupal 7.11
- Drupal 7.12
- Drupal 7.13
- Drupal 7.14
- Drupal 7.15
- Drupal 7.16
- Drupal 7.17
- Drupal 7.18
- Drupal 7.19
- Drupal 7.20
- Drupal 7.21
- Drupal 7.22
- Drupal 7.23
- Drupal 7.24
- Drupal 7.25
- Drupal 7.26
- Drupal 7.27
- Drupal 7.28
- Drupal 7.29
- Drupal 7.30
- Drupal 7.31
- Drupal 7.32
- Drupal 7.33
- Drupal 7.34
- Drupal 7.35
- Drupal 7.36
- Drupal 7.37
- Drupal 7.38
- Drupal 7.39
- Drupal 7.40
- Drupal 7.41
- Drupal 7.42
- Drupal 7.43
- Drupal 7.44
- Drupal 7.50
- Drupal 7.51
- Drupal 7.52
- Drupal 7.53
- Drupal 7.54
- Drupal 7.55
- Drupal 7.56
- Drupal 7.57
- Drupal 7.58
- Drupal 7.59
- Drupal 8.0.0
- Drupal 8.0.1
- Drupal 8.0.2
- Drupal 8.0.3
- Drupal 8.0.4
- Drupal 8.0.5
- Drupal 8.0.6
- Drupal 8.1.0
- Drupal 8.1.1
- Drupal 8.1.2
- Drupal 8.1.3
- Drupal 8.1.4
- Drupal 8.1.5
- Drupal 8.1.6
- Drupal 8.1.7
- Drupal 8.1.8
- Drupal 8.1.9
- Drupal 8.1.10
- Drupal 8.2.0
- Drupal 8.2.1
- Drupal 8.2.2
- Drupal 8.2.3
- Drupal 8.2.4
- Drupal 8.2.5
- Drupal 8.2.6
- Drupal 8.2.7
- Drupal 8.2.8
- Drupal 8.3.0
- Drupal 8.3.1
- Drupal 8.3.2
- Drupal 8.3.3
- Drupal 8.3.4
- Drupal 8.3.5
- Drupal 8.3.6
- Drupal 8.3.7
- Drupal 8.3.8
- Drupal 8.3.9
- Drupal 8.4.0
- Drupal 8.4.1
- Drupal 8.4.2
- Drupal 8.4.3
- Drupal 8.4.4
- Drupal 8.4.5
- Drupal 8.4.6
- Drupal 8.4.7
- Drupal 8.4.8
- Drupal 8.5.0
- Drupal 8.5.1
- Drupal 8.5.2
- Drupal 8.5.3
- Drupal 8.5.4
- Drupal 8.5.5
- Drupal 8.5.6
- Drupal 8.5.7
- Drupal 8.6.0
- Drupal 8.6.1