Description
CRLF injection vulnerability in the drupal_goto function in includes/common.inc Drupal 4.7.x before 4.7.8 and 5.x before 5.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
References
- http://drupal.org/node/184315
- ADV-2007-3546 vdb-entry
- drupal-unspecified-response-splitting(37264) vdb-entry
- 27292 third-party-advisory
- FEDORA-2007-2649 vendor-advisory
- 27352 third-party-advisory
- 26119 vdb-entry