CVE-2018-1000671

MEDIUMNuclei

Sympa version =>6.2.16 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2018-1000671 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMSympa version =>6.2.16 - Cross-Site ScriptingCVSS 6.1

Sympa version 6.2.16 and later contains a URL Redirection to Untrusted Site vulnerability in the referer parameter of the wwsympa fcgi login action that can result in open redirection and reflected cross-site scripting via data URIs.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to a patched version of Sympa (>=6.2.17) or apply the necessary security patches provided by the vendor.

WeaknessesCWE-601
Authors0x_Akoko
Template tagscvecve2018redirectsympadebianvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:sympa:sympa:*:*:*:*:*:*:*:*
Shodan: http.html:"sympa"
FOFA: body="sympa"
https://github.com/sympa-community/sympa/issues/268 https://vuldb.com/?id.123670 https://nvd.nist.gov/vuln/detail/CVE-2018-1000671 https://lists.debian.org/debian-lts-announce/2018/09/msg00023.html https://lists.debian.org/debian-lts-announce/2020/11/msg00015.html

Source: ProjectDiscovery

References

5