CVE-2018-1000671

sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.

CVSS v3.0

6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N

EPSS

3.98% chance of exploitation in the next 30 days, 90th percentile

Nuclei

medium · CWE-601

Published

2018-09-06

Updated

2024-08-05

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000671.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2018-1000670
• CVE-2018-1000773
• CVE-2018-1000669
• CVE-2018-1000801
• CVE-2018-1000667
• CVE-2018-1000802