PT-2023-32635 · Opencms · Opencms

Miguel Segovia Gil · Published 2023-12-13 · Updated 2025-02-05 · CVE-2023-6380

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open CMS versions 14 through 15 of the 'Mercury' template

Description An open redirect vulnerability has been found in the Open CMS product. This issue allows an attacker to create a specially crafted URL and send it to a specific user, redirecting them to a malicious site and potentially compromising them. The exploitation of this vulnerability is possible due to the lack of proper sanitization of the URI parameter.

Recommendations For versions 14 and 15 of the 'Mercury' template, consider disabling the functionality that uses the URI parameter until a patch is available. Restrict access to the affected 'Mercury' template to minimize the risk of exploitation. Avoid using the URI parameter in affected URLs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2023-6380

Affected Products

Opencms

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-6380 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6380 · Vendor Advisory
• https://t.me/cvenotify/63427 · Telegram Post
• https://twitter.com/Funker_Dev/status/1887056202317656490 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alkacon-software-opencms · Note
• https://twitter.com/VulmonFeeds/status/1734932455818146117 · Twitter Post
• https://twitter.com/CVEnew/status/1734894378672656439 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6380 · Note