CVE-2010-2021

MEDIUM 5.8CVE-2010-2021 · Published 25/06/2012 · updated 16/06/2026

In short

CVE-2010-2021 is a MEDIUM (CVSS 5.8) vulnerability affecting global redirect (nicholasthompson).
Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 85.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
global redirect nicholasthompson	`= 6.x-1.0= 6.x-1.1= 6.x-1.2= 6.x-1.3= 6.x-1.x= 7.x-1.3= 7.x-1.x`	No fix yet

Description

Open redirect vulnerability in the Global Redirect module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, when non-clean to clean is enabled, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter.

References

drupal.org/node/1633054 · Patch
drupal.org/node/768244
secunia.com/advisories/49523 · Vendor Advisory
madirish.net · Patch
openwall.com/lists/oss-security/2012/06/14/3
osvdb.org/82959
securityfocus.com/bid/54002
drupal.org/node/1378116 · Patch
drupal.org/node/1378118 · Patch
exchange.xforce.ibmcloud.com/vulnerabilities/76293

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free