Published: 01/03/2018 Updated: 22/03/2018

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 4.7 | Impact Score: 2.7 | Exploitability Score: 1.6

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

Drupal core 7.x versions prior to 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an malicious user to trick users into unwillingly navigating to an external site.

Vulnerable Product	Search on Vulmon	Subscribe to Product
drupal drupal
debian debian linux 8.0
debian debian linux 7.0
debian debian linux 9.0

Debian Bug report logs - #891154 drupal7: CVE-2017-6932: A-CORE-2018-001: External link injection on 404 pages when linking to the current page Package: src:drupal7; Maintainer for src:drupal7 is Gunnar Wolf <gwolf@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 22 Feb 2018 19:51:01 UTC ...

Multiple vulnerabilities have been found in the Drupal content management framework For additional information, please refer to the upstream advisory at wwwdrupalorg/sa-core-2018-001 For the oldstable distribution (jessie), this problem has been fixed in version 732-1+deb8u10 For the stable distribution (stretch), this problem has been ...

CWE-601 https://www.drupal.org/sa-core-2018-001 https://www.debian.org/security/2018/dsa-4123 https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891154 https://nvd.nist.gov https://www.debian.org/security/./dsa-4123

CVE-2017-6932

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect