CVE-2018-14474

MEDIUMNuclei

Orange Forum 1.4.0 - Open Redirect

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2018-14474 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMOrange Forum 1.4.0 - Open RedirectCVSS 6.1

Orange Forum 1.4.0 contains an open redirect vulnerability in views/auth.go via the next parameter to /login or /signup. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the installation of malware.

Remediation

Upgrade to a patched version of Orange Forum or apply the necessary security patches to fix the open redirect vulnerability.

WeaknessesCWE-601
Authors0x_Akoko
Template tagscve2018cveredirectorangeforumossseclistsgoodoldwebvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:goodoldweb:orange_forum:1.4.0:*:*:*:*:*:*:*
https://github.com/s-gv/orangeforum/commit/1f6313cb3a1e755880fc1354f3e1efc4dd2dd4aa https://seclists.org/fulldisclosure/2019/Jan/32 https://vuldb.com/?id.122045 https://nvd.nist.gov/vuln/detail/CVE-2018-14474 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2