drupal/core · Security
Drupal External URL injection through URL aliases leading to Open Redirect
- GHSA ID
- GHSA-7f4f-p7mq-p4fv
- Severity
- medium
- Published
- Updated
Description
The path module in Drupal allows users with the 'administer paths' to create pretty URLs for content. In certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url.
CWEs
- CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')