PT-2023-10616 · Unknown · Symbiote Seed

Published 2023-01-07 · Updated 2024-05-17 · CVE-2017-20164

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symbiote Seed versions up to 6.0.2

Description A critical issue was found in the onBeforeSecurityLogin function of the code/extensions/SecurityLoginExtension.php file in the Login component. The manipulation of the URL argument leads to an open redirect. This issue can be exploited remotely.

Recommendations To address this issue, upgrade to version 6.0.3. As a temporary workaround, consider restricting access to the onBeforeSecurityLogin function until the patch is applied. Additionally, avoid using the URL argument in the affected component until the issue is resolved.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2017-20164

GHSA-WM32-3R4M-JVCC

Affected Products

Symbiote Seed

References · 11

• https://github.com/symbiote/silverstripe-seed/releases/tag/6.0.3 · Patch
• https://github.com/symbiote/silverstripe-seed/commit/b065ebd82da53009d273aa7e989191f701485244 · Patch
• https://osv.dev/vulnerability/GHSA-wm32-3r4m-jvcc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-20164 · Security Note
• https://osv.dev/vulnerability/CVE-2017-20164 · Vendor Advisory
• https://github.com/symbiote/silverstripe-seed · Note
• https://vuldb.com/?ctiid.217626 · Note
• https://t.me/cvenotify/41503 · Telegram Post
• https://vuldb.com/?id.217626 · Note
• https://t.me/cvenotify/41870 · Telegram Post
• https://t.me/cibsecurity/56122 · Telegram Post