PT-2024-22381 · Unknown · Instinct Ui Web Client

Published 2024-04-02 · Updated 2024-08-27 · CVE-2024-28287

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions INSTINCT UI Web Client version 6.5.0

Description A DOM-based open redirection in the returnUrl parameter allows attackers to redirect users to malicious sites via a crafted URL.

Recommendations For INSTINCT UI Web Client version 6.5.0, consider restricting access to the returnUrl parameter to minimize the risk of exploitation. Avoid using the returnUrl parameter in crafted URLs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-28287

Affected Products

Instinct Ui Web Client

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-28287 · Security Note
• https://twitter.com/VulmonFeeds/status/1775228934809915734 · Twitter Post
• https://medium.com/%40rajput.thakur/dom-based-malicious-redirection-cve-2024-28287-304ac8e7f992 · Note
• https://t.me/cvenotify/75521 · Telegram Post
• https://t.me/cvenotify/75498 · Telegram Post
• https://twitter.com/CVEnew/status/1775201518666330318 · Twitter Post