CVE-2016-9451
Drupal Open Redirect
CVE-2016-9451 is a medium vulnerability (CVSS 6.8) in Drupal, published November 17, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 74th percentile. Fixed in drupal/core 7.52.
Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.
- Record
CVE-2016-9451- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N - CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
CVE List No score
Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.
- Record
CVE-2016-9451- Updated
- 2026-11-02
EUVDEUVD-2022-2726 No score
Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.
- Record
EUVD-2022-2726- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-66gr-xrcf-8jpq
Drupal Open Redirect
Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.
- Record
GHSA-66gr-xrcf-8jpq- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.
- Record
CVE-2016-9451- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-66gr-xrcf-8jpq
Drupal Open Redirect
Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.
- Record
GHSA-66gr-xrcf-8jpq- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-9451
Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.
- Record
UBUNTU-CVE-2016-9451- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2016-0413 No score
Updated drupal packages fix security vulnerability
Inconsistent name for term access query; information on taxonomy terms might have been disclosed to unprivileged users (CVE-2016-9449).
Confirmation forms allow external URLs to be injected (CVE-2016-9451).
- Record
MGASA-2016-0413- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/corePackagist |
7.0 up to 7.52 | 7.52 |
drupal/corePackagist |
8.0 up to 8.2.3 | 8.2.3 |
drupal7Debian:7 |
before 7.14-2+deb7u15, plus listed versions 7.14-27.14-2+deb7u17.14-2+deb7u107.14-2+deb7u10~bpo60+17.14-2+deb7u11 Show 18 moreShow less7.14-2+deb7u11~bpo60+17.14-2+deb7u127.14-2+deb7u137.14-2+deb7u147.14-2+deb7u1~bpo60+17.14-2+deb7u27.14-2+deb7u2~bpo60+17.14-2+deb7u37.14-2+deb7u47.14-2+deb7u4~bpo60+17.14-2+deb7u57.14-2+deb7u67.14-2+deb7u6~bpo60+17.14-2+deb7u77.14-2+deb7u7~bpo60+17.14-2+deb7u87.14-2+deb7u97.14-2+deb7u9~bpo60+1 |
7.14-2+deb7u15 |
drupal7Debian:8 |
before 7.32-1+deb8u8, plus listed versions 7.32-1+deb8u37.32-1+deb8u47.32-1+deb8u4~bpo70+17.32-1+deb8u57.32-1+deb8u5~bpo70+17.32-1+deb8u67.32-1+deb8u7 |
7.32-1+deb8u8 |
drupal/corePackagist |
8.0 up to 8.2.3, plus listed versions 8.0.08.0.0-beta108.0.0-beta118.0.0-beta128.0.0-beta13 Show 39 moreShow less8.0.0-beta148.0.0-beta158.0.0-beta168.0.0-beta68.0.0-beta78.0.0-beta88.0.0-beta98.0.0-rc18.0.0-rc28.0.0-rc38.0.0-rc48.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.2 |
8.2.3 |
drupalMageia:5 |
before 7.52-1.mga5 | 7.52-1.mga5 |
drupal7Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3 |
None known |
drupal7Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 7.38-17.41-17.44-1ubuntu1~16.04.07.44-1ubuntu1~16.04.0+esm17.44-1ubuntu1~16.04.0+esm27.44-1ubuntu1~16.04.0+esm3 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
debian.org/security/2016/dsa-3718
securityfocus.com/bid/94367
drupal.org/SA-CORE-2016-005
nvd.nist.gov/vuln/detail/CVE-2016-9451
github.com/advisories/GHSA-66gr-xrcf-8jpq
Show 24 moreShow less
advisories.mageia.org/MGASA-2016-0413.html
bugs.mageia.org/show_bug.cgi?id=19812
openwall.com/lists/oss-security/2016/11/18/16
lwn.net/Vulnerabilities/707038
ubuntu.com/security/CVE-2016-9451
openwall.com/lists/oss-security/2016/11/18/8
cve.org/CVERecord?id=CVE-2016-9451