URL Shortify <= 1.12.1 - Unauthenticated Open Redirect via 'redirect_to' Parameter
50Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 4.7epss 0.6%
de la publicación al arma
Publicada en NVD18 feb
VulnCheck+43d
probabilidad de explotación
0.6%top 55% de las CVE
explotación observada
síVulnCheck
The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Productos afectados
kaizencoders · URL Shortify – Simple and Easy URL ShortenerReferencias
https://plugins.trac.wordpress.org/browser/url-shortify/tags/1.11.4/lite/includes/Promo.php#L64https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3451740%40url-shortify&old=3445491%40url-shortify&sfp_email=&sfph_mail=#file1049https://www.wordfence.com/threat-intel/vulnerabilities/id/c7c1dc51-47ca-4b2f-9ff9-275bd8b1c106?source=cve