PT-2024-38171 · Duende+1 · Duende Identityserver+1

Published 2024-08-01 · Updated 2025-05-20 · CVE-2024-7211

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions 1E Platform (affected versions not specified) Duende Identity Server (affected versions not specified)

Description The issue concerns an open redirect vulnerability in the Duende Identity Server, a third-party component used by the 1E Platform. This vulnerability allows an attacker to control the redirection path of end users, potentially redirecting them to untrusted sites.

Recommendations For the 1E Platform, update the component utilizing the Duende Identity Server with the patch that includes the fix. For the Duende Identity Server, apply the necessary patch to resolve the issue. As a temporary workaround, consider restricting URL redirection to trusted sites until the patch is applied.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-7211

Affected Products

1E Platform

Duende Identityserver

References · 10

• https://1e.com/trust-security-compliance/cve-info · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7211 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7211 · Vendor Advisory
• https://t.me/cvenotify/93547 · Telegram Post
• https://t.me/cvenotify/88551 · Telegram Post
• https://t.me/cvenotify/88279 · Telegram Post
• https://t.me/cvenotify/88525 · Telegram Post
• https://teamviewer.com/en/resources/trust-center/security-bulletins/1e-2024-2001 · Note
• https://t.me/cvenotify/123040 · Telegram Post
• https://t.me/cvedetector/2253 · Telegram Post