PT-2022-13364 · Unknown · Rudloff/Alltube

Published 2022-02-21 · Updated 2022-02-28 · CVE-2022-0692

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions rudloff/alltube versions prior to 3.0.1

Description The issue allows an attacker to construct a URL that redirects to an arbitrary external domain. This is due to an open redirect vulnerability in releases prior to 3.0.1.

Recommendations For versions prior to 3.0.1, update to version 3.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable rudloff/alltube module to minimize the risk of exploitation.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-0692

GHSA-JMHF-9FJ8-88GH

Affected Products

Rudloff/Alltube

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0692.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/rudloff/alltube/CVE-2022-0692.yaml · Exploit
• 🔥 https://huntr.dev/bounties/4fb39400-e08b-47af-8c1f-5093c9a51203 · Exploit
• https://github.com/rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0692 · Security Note
• https://osv.dev/vulnerability/GHSA-jmhf-9fj8-88gh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0692 · Vendor Advisory
• https://github.com/Rudloff/alltube/security/advisories/GHSA-jmhf-9fj8-88gh · Note
• https://github.com/Rudloff/alltube · Note
• https://t.me/cibsecurity/37857 · Telegram Post
• https://t.me/cvenotify/27151 · Telegram Post
• https://t.me/cvenotify/27133 · Telegram Post