PT-2022-27668 · Cyface · Cyface Terms/Conditions Module

Amarsahinovic · Published 2022-12-17 · Updated 2024-05-17 · CVE-2022-4589

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions cyface Terms and Conditions Module versions prior to 2.0.11

Description A vulnerability has been found in the cyface Terms and Conditions Module, classified as problematic. The issue affects the returnTo function of the file termsandconditions/views.py, leading to an open redirect. This manipulation can be launched remotely.

Recommendations To address this issue, upgrade to version 2.0.11. As a temporary workaround, consider restricting access to the returnTo function of the termsandconditions/views.py file until the upgrade is applied.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-4589

GHSA-6RMF-CV6P-4H27

Affected Products

Cyface Terms/Conditions Module

References · 11

• https://github.com/cyface/django-termsandconditions/pull/239 · Patch
• https://github.com/cyface/django-termsandconditions/releases/tag/v2.0.10 · Patch
• https://github.com/cyface/django-termsandconditions/commit/03396a1c2e0af95e12a45c5faef7e47a4b513e1a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4589 · Security Note
• https://osv.dev/vulnerability/GHSA-6rmf-cv6p-4h27 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4589 · Vendor Advisory
• https://github.com/cyface/django-termsandconditions · Note
• https://github.com/cyface/django-termsandconditions/releases/tag/v2.0.11 · Note
• https://t.me/cibsecurity/54799 · Telegram Post
• https://t.me/cvenotify/40607 · Telegram Post
• https://vuldb.com/?id.216175 · Note