Description

Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a double-encoded URL in the "destination" parameter.

Remediation

References

CVE-2016-3167

Related Vulnerabilities

WordPress Plugin TC Custom JavaScript Cross-Site Scripting (1.2.1)

WordPress Plugin Rich Reviews Multiple Vulnerabilities (1.7.3)

WordPress 2.0.5 Cross-Site Scripting Vulnerability (0.6.2 - 2.0.5)

Dolibarr Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-3935)

Drupal Core 8.x Security Bypass (8.0.0 - 8.1.2)

Severity

High

Classification

CVE-2016-3167 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities