Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL.

The vulnerability is caused by insufficient validation of the destination query parameter in the drupal_goto() function.

Other versions of Drupal core are not vulnerable.

References

• https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2020-05-20-1.yaml
• https://www.drupal.org/sa-core-2020-003