GHSA-r67r-42wx-c8r7: 
PHP vulnerability analysis and mitigation

The vulnerability (GHSA-r67r-42wx-c8r7) is an External URL injection through URL aliases leading to Open Redirect in Drupal. The issue was discovered and disclosed on October 17, 2018, affecting Drupal versions 7.x (>=7.0, <7.60) and 8.x (>=8.0.0, <8.5.8 and >=8.6.0, <8.6.2). This moderately critical vulnerability exists in the path module of Drupal, which is used for creating pretty URLs for content (Drupal Advisory, GitHub Advisory).

The vulnerability exists in Drupal's path module, which allows users with 'administer paths' permission to create pretty URLs for content. Under specific circumstances, an authenticated user with this permission could enter a particular path that would trigger an open redirect to a malicious URL. The vulnerability is classified as CWE-601 (Open Redirect) with a moderate severity rating (GitHub Advisory).

The vulnerability could allow attackers to create malicious redirects, potentially leading users to harmful websites. However, the impact is somewhat limited as it requires an attacker to have administrative path privileges to exploit the vulnerability (Drupal Advisory).

The exploitability of this vulnerability is limited by the requirement that the attacker must possess the 'administer paths' permission in Drupal. This administrative privilege requirement serves as a significant mitigating factor in terms of exploitation potential (GitHub Advisory).

The vulnerability has been patched in Drupal versions 7.60, 8.5.8, and 8.6.2. Users are advised to upgrade to these versions or later to mitigate the vulnerability. For Drupal 7.x users, upgrading to version 7.60 is recommended. For Drupal 8.x users, upgrading to either version 8.5.8 or 8.6.2 depending on their current version is advised (Drupal Advisory).