CVE-2010-2021: Open redirect vulnerability in the Global Redirect module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4...

Security readout for executives and security teams

This issue lets a malicious link through a vulnerable Drupal Global Redirect module send users to an attacker-chosen website. The main business risk is phishing or brand abuse, not direct server takeover. Evidence provided does not show active exploitation. Exposure is likely limited to Drupal sites running the affected Global Redirect module versions with non-clean-to-clean enabled. Internet-facing Drupal sites are more exposed because attackers can distribute crafted links to users. Handle as a targeted phishing and trust-risk issue. It is less severe than code execution, but customer-facing domains can make phishing more credible. Prioritize remediation where the affected module is present on public Drupal properties. Mitigation focus: Upgrade Global Redirect to 6.x-1.4 or 7.x-1.4 or later.; Check Drupal advisory guidance for supported remediation details.; Inventory Drupal sites using the Global Redirect module..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.