Vulnerability Name: | CVE-2017-6932 (CCN-139344) | ||||||||||||||||||||
Assigned: | 2017-02-21 | ||||||||||||||||||||
Published: | 2017-02-21 | ||||||||||||||||||||
Updated: | 2018-03-22 | ||||||||||||||||||||
Summary: | Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an external site. | ||||||||||||||||||||
CVSS v3 Severity: | 4.7 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) 4.1 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)
5.1 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C)
| ||||||||||||||||||||
CVSS v2 Severity: | 5.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
| ||||||||||||||||||||
Vulnerability Type: | CWE-601 | ||||||||||||||||||||
Vulnerability Consequences: | Bypass Security | ||||||||||||||||||||
References: | Source: MITRE Type: CNA CVE-2017-6932 Source: XF Type: UNKNOWN drupal-externallink-open-redirect(139344) Source: MLIST Type: Third Party Advisory [debian-lts-announce] 20180228 [SECURITY] [DLA 1295-1] drupal7 security update Source: DEBIAN Type: Third Party Advisory DSA-4123 Source: CCN Type: SA-CORE-2018-001 Drupal core - Critical - Multiple Vulnerabilities Source: CONFIRM Type: Vendor Advisory https://www.drupal.org/sa-core-2018-001 | ||||||||||||||||||||
Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||||||||||
Oval Definitions | |||||||||||||||||||||
| |||||||||||||||||||||
BACK |