GHSA-6gf6-24h2-66j4: 
PHP vulnerability analysis and mitigation

Drupal 7 was found to contain an Open Redirect vulnerability, identified as SA-CORE-2020-003. The vulnerability was disclosed on May 20, 2020, affecting Drupal core versions from 7.0.0 to versions prior to 7.70. This security issue specifically impacts Drupal 7, while other versions of Drupal core were confirmed not to be vulnerable (Drupal Advisory).

The vulnerability stems from insufficient validation of the destination query parameter in the drupal_goto() function. The issue has been assigned a CVSS v3.1 base score of 4.3 (Moderate severity), with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: Required, Scope: Unchanged, Confidentiality: None, Integrity: Low, and Availability: None. The vulnerability is tracked under CVE-2020-13662 (GitHub Advisory).

The vulnerability allows attackers to perform open redirect attacks. Users could be tricked into visiting specially crafted links that would redirect them to arbitrary external URLs, potentially leading to phishing attacks or other malicious redirections (Drupal Advisory).

The vulnerability requires user interaction to be exploited, as victims need to click on specially crafted links. The attack complexity is considered low, and no special privileges are required to execute the attack (GitHub Advisory).

Users running affected versions of Drupal 7.x are advised to upgrade to Drupal 7.70, which contains the security fix. The fix was implemented by Drew Webber, Fabian Franz, David Snopek of the Drupal Security Team, and vortfu (Drupal Advisory).

The vulnerability was addressed through collaborative efforts from multiple organizations including Acquia and Tag1 Consulting, who sponsored time for this security release (Drupal Advisory).