A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulnerability allows authenticated attackers to redirect unprivileged users to an arbitrary, attacker-controlled webpage. When an authenticated user clicks on the malicious block item, they are redirected to the arbitrary untrusted domains, where sensitive tokens, such as JSON Web Tokens, can be stolen via a crafted webpage.
Metrics
Affected Vendors & Products
References
History
Tue, 17 Dec 2024 15:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Weaknesses | CWE-601 | |
Metrics |
cvssV3_1
|
Mon, 16 Dec 2024 22:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulnerability allows authenticated attackers to redirect unprivileged users to an arbitrary, attacker-controlled webpage. When an authenticated user clicks on the malicious block item, they are redirected to the arbitrary untrusted domains, where sensitive tokens, such as JSON Web Tokens, can be stolen via a crafted webpage. | |
References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2024-12-16T00:00:00
Updated: 2024-12-17T14:42:59.416Z
Reserved: 2024-12-06T00:00:00
Link: CVE-2024-55452
Vulnrichment
Updated: 2024-12-17T14:42:53.276Z
NVD
Status : Awaiting Analysis
Published: 2024-12-16T23:15:06.817
Modified: 2024-12-17T15:15:16.287
Link: CVE-2024-55452
Redhat
No data.