Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL.
The vulnerability was caused by insufficient validation of the destination query parameter in the drupal_goto() function.
This vulnerability affects the following application versions:
- Drupal 7.0
- Drupal 7.1
- Drupal 7.2
- Drupal 7.3
- Drupal 7.4
- Drupal 7.5
- Drupal 7.6
- Drupal 7.7
- Drupal 7.8
- Drupal 7.9
- Drupal 7.10
- Drupal 7.11
- Drupal 7.12
- Drupal 7.13
- Drupal 7.14
- Drupal 7.15
- Drupal 7.16
- Drupal 7.17
- Drupal 7.18
- Drupal 7.19
- Drupal 7.20
- Drupal 7.21
- Drupal 7.22
- Drupal 7.23
- Drupal 7.24
- Drupal 7.25
- Drupal 7.26
- Drupal 7.27
- Drupal 7.28
- Drupal 7.29
- Drupal 7.30
- Drupal 7.31
- Drupal 7.32
- Drupal 7.33
- Drupal 7.34
- Drupal 7.35
- Drupal 7.36
- Drupal 7.37
- Drupal 7.38
- Drupal 7.39
- Drupal 7.40
- Drupal 7.41
- Drupal 7.42
- Drupal 7.43
- Drupal 7.44
- Drupal 7.50
- Drupal 7.51
- Drupal 7.52
- Drupal 7.53
- Drupal 7.54
- Drupal 7.55
- Drupal 7.56
- Drupal 7.57
- Drupal 7.58
- Drupal 7.59
- Drupal 7.60
- Drupal 7.61
- Drupal 7.62
- Drupal 7.63
- Drupal 7.64
- Drupal 7.65
- Drupal 7.66
- Drupal 7.67
- Drupal 7.68
- Drupal 7.69