Description Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect. Remediation References CVE-2019-11016 Related Vulnerabilities Drupal Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2015-6659) Oracle Database Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-0275) MySQL Improper Input Validation Vulnerability (CVE-2017-3256) Envoy Proxy Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2020-12604) Oracle Application Server Other Vulnerability (CVE-2002-0560) Severity Medium Classification CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Tags Missing Update Known Vulnerabilities CWE-601 CVE-2019-11016