Drupal core and contributed modules frequently use a "destination" query string parameter in URLs to redirect users to a new destination after completing an action on the current page. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks.

References

• https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2018-10-17-3.yaml
• https://www.drupal.org/sa-core-2018-006