← volver
CVE-2017-20164

Symbiote Seed Login SecurityLoginExtension.php onBeforeSecurityLogin redirect

CVSS 6.3 MEDIUMEPSS 0.5%CWE-601
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 6.3EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Ciclo de vida
07 ene 2023Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
A vulnerability was found in Symbiote Seed up to 6.0.2. It has been classified as critical. Affected is the function onBeforeSecurityLogin of the file code/extensions/SecurityLoginExtension.php of the component Login. The manipulation of the argument URL leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 6.0.3 is able to address this issue. The patch is identified as b065ebd82da53009d273aa7e989191f701485244. It is recommended to upgrade the affected component. VDB-217626 is the identifier assigned to this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Productos afectados
Symbiote · Seed

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →
Referencias
https://github.com/symbiote/silverstripe-seed/commit/b065ebd82da53009d273aa7e989191f701485244https://github.com/symbiote/silverstripe-seed/releases/tag/6.0.3https://vuldb.com/?ctiid.217626https://vuldb.com/?id.217626