Description:
Drupal 7 has an Open Redirect vulnerability. For example, a user could be
tricked into visiting a specially crafted link which would redirect them to
an arbitrary external URL.
The vulnerability is caused by insufficient validation of the destination
query parameter in the drupal_goto() function.
Other versions of Drupal core are not vulnerable.
Solution:
Install the latest version
Drupal 7.7.1 release note:
Maintenance release of the Drupal 7 series. Includes bug fixes and small API/feature improvements only (no major, non-backwards-compatible new functionality).
No security fixes are included in this release.
This is the first release to fully support PHP 7.4.
Security Advisory - https://www.drupal.org/sa-core-2020-003 Project: Drupal core [1] Date: 2020-May-20 Security risk: Moderately critical 10∕25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Open Redirect
Description: Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL.
The vulnerability is caused by insufficient validation of the destination query parameter in the drupal_goto() function.
Other versions of Drupal core are not vulnerable.
Solution: Install the latest version
Drupal 7.7.1 release note:
Maintenance release of the Drupal 7 series. Includes bug fixes and small API/feature improvements only (no major, non-backwards-compatible new functionality).
No security fixes are included in this release.
This is the first release to fully support PHP 7.4.