CVE-2018-15683

MEDIUM

BTITeam XBTIT < 2.5.4 - Open Redirect via Login Page Returnto Parameter

Title source: llm
STIX 2.1

Description

An issue was discovered in BTITeam XBTIT. The "returnto" parameter of the login page is vulnerable to an open redirect due to a lack of validation. If a user is already logged in when accessing the page, they will be instantly redirected.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://rastating.github.io/xbtit-multiple-vulnerabilities/

Scores

CVSS v3 6.1
EPSS 0.0070
EPSS Percentile 48.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-601
Status published
Products (1)
btiteam/xbtit < 2.5.4
Published Sep 05, 2018
Tracked Since Feb 18, 2026