PT-2023-32635 · Opencms · Opencms

Miguel Segovia Gil · Publicado 2023-12-13 · Atualizado 2025-02-05 · CVE-2023-6380

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open CMS versions 14 through 15 of the 'Mercury' template

Description An open redirect vulnerability has been found in the Open CMS product. This issue allows an attacker to create a specially crafted URL and send it to a specific user, redirecting them to a malicious site and potentially compromising them. The exploitation of this vulnerability is possible due to the lack of proper sanitization of the URI parameter.

Recommendations For versions 14 and 15 of the 'Mercury' template, consider disabling the functionality that uses the URI parameter until a patch is available. Restrict access to the affected 'Mercury' template to minimize the risk of exploitation. Avoid using the URI parameter in affected URLs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2023-6380

Produtos afetados

Opencms

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-6380 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-6380 · Aviso do Fabricante
• https://t.me/cvenotify/63427 · Publicação no Telegram
• https://twitter.com/Funker_Dev/status/1887056202317656490 · Publicação no Twitter
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alkacon-software-opencms · Nota
• https://twitter.com/VulmonFeeds/status/1734932455818146117 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1734894378672656439 · Publicação no Twitter
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6380 · Nota