PT-2021-9639 · Phpgacl+1 · Phpgacl+1

Published 2021-01-30 · Updated 2022-10-07 · CVE-2020-13565

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpGACL version 3.3.7 OpenEMR version 5.0.2 OpenEMR development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce)

Description An open redirect issue exists in the return page redirection functionality. A specially crafted HTTP request can redirect users to an arbitrary URL. An attacker can provide a crafted URL to trigger this issue.

Recommendations For phpGACL version 3.3.7, update the return page redirection functionality to validate URLs and prevent redirects to arbitrary locations. For OpenEMR version 5.0.2, modify the return page redirection functionality to ensure it only redirects to trusted URLs. For OpenEMR development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce), revise the return page redirection functionality to properly validate and sanitize user-inputted URLs.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2020-13565

Affected Products

Openemr

Phpgacl

References · 7

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1178 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-13565 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13565 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13565 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13565 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13565 · Security Note
• https://t.me/cybersecuritytechnologies/2599 · Telegram Post