PT-2022-12344 · Seeddms · Seeddms

Published 2022-02-04 · Updated 2022-02-09 · CVE-2021-45408

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SeedDMS version 6.0.15

Description The issue allows remote malicious users to redirect users to malicious sites. This is achieved by exploiting the referuri parameter in the out.Login.php file.

Recommendations For SeedDMS version 6.0.15, consider restricting the use of the referuri parameter in the out.Login.php file until a patch is available. Avoid using the referuri parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-45408

Affected Products

Seeddms

References · 4

• 🔥 https://sunil-singh.notion.site/SeedDMS-6-0-15-Open-Redirect-85be8b681b2947a2a75e7416cb56670c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-45408 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45408 · Vendor Advisory
• https://t.me/cibsecurity/36878 · Telegram Post