CVE-2016-3164 Drupal Open Redirect
HighCVSS 7.4
EPSS 1.9%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal/drupal(Packagist) | >= 6.0, < 6.38 | 6.38 |
| drupal/drupal(Packagist) | >= 7.0, < 7.43 | 7.43 |
| drupal/drupal(Packagist) | >= 8.0, < 8.0.4 | 8.0.4 |
| drupal/drupal(Packagist) | = 8.0.0 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-alpha14 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-alpha15 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta1 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta10 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta11 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta12 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta13 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta14 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta15 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta16 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta2 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta3 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta4 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta5 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta6 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta7 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta9 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-rc1 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-rc2 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-rc3 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-rc4 | No fix listed |
Show 168 more
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal/drupal(Packagist) | = 8.0.1 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.2 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.3 | No fix listed |
| drupal/core(Packagist) | >= 8.0, < 8.0.4 | 8.0.4 |
| drupal/core(Packagist) | = 8.0.0 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta10 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta11 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta12 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta13 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta14 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta15 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta16 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta6 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta7 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta8 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta9 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc1 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc2 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc3 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc4 | No fix listed |
| drupal/core(Packagist) | = 8.0.1 | No fix listed |
| drupal/core(Packagist) | = 8.0.2 | No fix listed |
| drupal/core(Packagist) | = 8.0.3 | No fix listed |
| drupal/core(Packagist) | >= 7.0, < 7.43 | 7.43 |
| drupal/core(Packagist) | >= 6.0, < 6.38 | 6.38 |
| drupal/drupal | = 6.0 | No fix listed |
| drupal/drupal | = 6.0-beta1 | No fix listed |
| drupal/drupal | = 6.0-beta2 | No fix listed |
| drupal/drupal | = 6.0-beta3 | No fix listed |
| drupal/drupal | = 6.0-beta4 | No fix listed |
| drupal/drupal | = 6.0-dev | No fix listed |
| drupal/drupal | = 6.0-rc1 | No fix listed |
| drupal/drupal | = 6.0-rc2 | No fix listed |
| drupal/drupal | = 6.0-rc3 | No fix listed |
| drupal/drupal | = 6.0-rc4 | No fix listed |
| drupal/drupal | = 6.1 | No fix listed |
| drupal/drupal | = 6.2 | No fix listed |
| drupal/drupal | = 6.3 | No fix listed |
| drupal/drupal | = 6.4 | No fix listed |
| drupal/drupal | = 6.5 | No fix listed |
| drupal/drupal | = 6.6 | No fix listed |
| drupal/drupal | = 6.7 | No fix listed |
| drupal/drupal | = 6.8 | No fix listed |
| drupal/drupal | = 6.9 | No fix listed |
| drupal/drupal | = 6.10 | No fix listed |
| drupal/drupal | = 6.11 | No fix listed |
| drupal/drupal | = 6.12 | No fix listed |
| drupal/drupal | = 6.13 | No fix listed |
| drupal/drupal | = 6.14 | No fix listed |
| drupal/drupal | = 6.15 | No fix listed |
| drupal/drupal | = 6.16 | No fix listed |
| drupal/drupal | = 6.17 | No fix listed |
| drupal/drupal | = 6.18 | No fix listed |
| drupal/drupal | = 6.19 | No fix listed |
| drupal/drupal | = 6.20 | No fix listed |
| drupal/drupal | = 6.21 | No fix listed |
| drupal/drupal | = 6.22 | No fix listed |
| drupal/drupal | = 6.23 | No fix listed |
| drupal/drupal | = 6.24 | No fix listed |
| drupal/drupal | = 6.25 | No fix listed |
| drupal/drupal | = 6.26 | No fix listed |
| drupal/drupal | = 6.27 | No fix listed |
| drupal/drupal | = 6.28 | No fix listed |
| drupal/drupal | = 6.29 | No fix listed |
| drupal/drupal | = 6.30 | No fix listed |
| drupal/drupal | = 6.31 | No fix listed |
| drupal/drupal | = 6.32 | No fix listed |
| drupal/drupal | = 6.33 | No fix listed |
| drupal/drupal | = 6.34 | No fix listed |
| drupal/drupal | = 6.35 | No fix listed |
| drupal/drupal | = 6.36 | No fix listed |
| drupal/drupal | = 6.37 | No fix listed |
| drupal/drupal | = 7.0 | No fix listed |
| drupal/drupal | = 7.0-alpha1 | No fix listed |
| drupal/drupal | = 7.0-alpha2 | No fix listed |
| drupal/drupal | = 7.0-alpha3 | No fix listed |
| drupal/drupal | = 7.0-alpha4 | No fix listed |
| drupal/drupal | = 7.0-alpha5 | No fix listed |
| drupal/drupal | = 7.0-alpha6 | No fix listed |
| drupal/drupal | = 7.0-alpha7 | No fix listed |
| drupal/drupal | = 7.0-beta1 | No fix listed |
| drupal/drupal | = 7.0-beta2 | No fix listed |
| drupal/drupal | = 7.0-beta3 | No fix listed |
| drupal/drupal | = 7.0-dev | No fix listed |
| drupal/drupal | = 7.0-rc1 | No fix listed |
| drupal/drupal | = 7.0-rc2 | No fix listed |
| drupal/drupal | = 7.0-rc3 | No fix listed |
| drupal/drupal | = 7.0-rc4 | No fix listed |
| drupal/drupal | = 7.1 | No fix listed |
| drupal/drupal | = 7.2 | No fix listed |
| drupal/drupal | = 7.3 | No fix listed |
| drupal/drupal | = 7.4 | No fix listed |
| drupal/drupal | = 7.5 | No fix listed |
| drupal/drupal | = 7.6 | No fix listed |
| drupal/drupal | = 7.7 | No fix listed |
| drupal/drupal | = 7.8 | No fix listed |
| drupal/drupal | = 7.9 | No fix listed |
| drupal/drupal | = 7.10 | No fix listed |
| drupal/drupal | = 7.11 | No fix listed |
| drupal/drupal | = 7.12 | No fix listed |
| drupal/drupal | = 7.13 | No fix listed |
| drupal/drupal | = 7.14 | No fix listed |
| drupal/drupal | = 7.15 | No fix listed |
| drupal/drupal | = 7.16 | No fix listed |
| drupal/drupal | = 7.17 | No fix listed |
| drupal/drupal | = 7.18 | No fix listed |
| drupal/drupal | = 7.19 | No fix listed |
| drupal/drupal | = 7.20 | No fix listed |
| drupal/drupal | = 7.21 | No fix listed |
| drupal/drupal | = 7.22 | No fix listed |
| drupal/drupal | = 7.23 | No fix listed |
| drupal/drupal | = 7.24 | No fix listed |
| drupal/drupal | = 7.25 | No fix listed |
| drupal/drupal | = 7.26 | No fix listed |
| drupal/drupal | = 7.27 | No fix listed |
| drupal/drupal | = 7.28 | No fix listed |
| drupal/drupal | = 7.29 | No fix listed |
| drupal/drupal | = 7.30 | No fix listed |
| drupal/drupal | = 7.31 | No fix listed |
| drupal/drupal | = 7.32 | No fix listed |
| drupal/drupal | = 7.33 | No fix listed |
| drupal/drupal | = 7.34 | No fix listed |
| drupal/drupal | = 7.35 | No fix listed |
| drupal/drupal | = 7.36 | No fix listed |
| drupal/drupal | = 7.37 | No fix listed |
| drupal/drupal | = 7.38 | No fix listed |
| drupal/drupal | = 7.40 | No fix listed |
| drupal/drupal | = 7.41 | No fix listed |
| drupal/drupal | = 7.42 | No fix listed |
| drupal/drupal | = 7.x-dev | No fix listed |
| drupal/drupal | = 8.0.0 | No fix listed |
| drupal/drupal | = 8.0.0-alpha10 | No fix listed |
| drupal/drupal | = 8.0.0-alpha11 | No fix listed |
| drupal/drupal | = 8.0.0-alpha12 | No fix listed |
| drupal/drupal | = 8.0.0-alpha13 | No fix listed |
| drupal/drupal | = 8.0.0-alpha14 | No fix listed |
| drupal/drupal | = 8.0.0-alpha15 | No fix listed |
| drupal/drupal | = 8.0.0-alpha2 | No fix listed |
| drupal/drupal | = 8.0.0-alpha3 | No fix listed |
| drupal/drupal | = 8.0.0-alpha4 | No fix listed |
| drupal/drupal | = 8.0.0-alpha5 | No fix listed |
| drupal/drupal | = 8.0.0-alpha6 | No fix listed |
| drupal/drupal | = 8.0.0-alpha7 | No fix listed |
| drupal/drupal | = 8.0.0-alpha8 | No fix listed |
| drupal/drupal | = 8.0.0-alpha9 | No fix listed |
| drupal/drupal | = 8.0.0-beta1 | No fix listed |
| drupal/drupal | = 8.0.0-beta10 | No fix listed |
| drupal/drupal | = 8.0.0-beta11 | No fix listed |
| drupal/drupal | = 8.0.0-beta12 | No fix listed |
| drupal/drupal | = 8.0.0-beta13 | No fix listed |
| drupal/drupal | = 8.0.0-beta14 | No fix listed |
| drupal/drupal | = 8.0.0-beta15 | No fix listed |
| drupal/drupal | = 8.0.0-beta16 | No fix listed |
| drupal/drupal | = 8.0.0-beta2 | No fix listed |
| drupal/drupal | = 8.0.0-beta3 | No fix listed |
| drupal/drupal | = 8.0.0-beta4 | No fix listed |
| drupal/drupal | = 8.0.0-beta6 | No fix listed |
| drupal/drupal | = 8.0.0-beta7 | No fix listed |
| drupal/drupal | = 8.0.0-beta9 | No fix listed |
| drupal/drupal | = 8.0.0-rc1 | No fix listed |
| drupal/drupal | = 8.0.0-rc2 | No fix listed |
| drupal/drupal | = 8.0.0-rc3 | No fix listed |
| drupal/drupal | = 8.0.0-rc4 | No fix listed |
| drupal/drupal | = 8.0.1 | No fix listed |
| drupal/drupal | = 8.0.2 | No fix listed |
| drupal/drupal | = 8.0.3 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit
- github.com exploit
- github.com product
- www.drupal.org patch vendor-advisory
- DSA-3498 vendor-advisory
- [oss-security] 20160224 CVE requests for Drupal core (SA-CORE-2016-001) mailing-list
- [oss-security] 20160315 Re: CVE requests for Drupal core (SA-CORE-2016-001) mailing-list
- github.com