6.5
CVE-2017-20164
- EPSS 0.52%
- Veröffentlicht 07.01.2023 20:15:09
- Zuletzt bearbeitet 21.11.2024 03:22:47
- Quelle cna@vuldb.com
- CVE-Watchlists
- Unerledigt
LoginSymbiote Seed Login SecurityLoginExtension.php onBeforeSecurityLogin redirect
A vulnerability was found in Symbiote Seed up to 6.0.2. It has been classified as critical. Affected is the function onBeforeSecurityLogin of the file code/extensions/SecurityLoginExtension.php of the component Login. The manipulation of the argument URL leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 6.0.3 is able to address this issue. The patch is identified as b065ebd82da53009d273aa7e989191f701485244. It is recommended to upgrade the affected component. VDB-217626 is the identifier assigned to this vulnerability.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.52% | 0.399 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
| cna@vuldb.com | 6.3 | 2.8 | 3.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
|
| cna@vuldb.com | 6.5 | 8 | 6.4 |
AV:N/AC:L/Au:S/C:P/I:P/A:P
|
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
https://github.com/symbiote/silverstripe-seed/commit/b065ebd82da53009d273aa7e989191f701485244
https://github.com/symbiote/silverstripe-seed/releases/tag/6.0.3
https://vuldb.com/?ctiid.217626
https://vuldb.com/?id.217626