CVE-2019-1010290

MEDIUMNuclei

Babel - Open Redirect

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2019-1010290 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Babel: Multilingual site Babel All is affected by: Open Redirection. The impact is: Redirection to any URL, which is supplied to redirect.php in a "newurl" parameter. The component is: redirect.php. The attack vector is: The victim must open a link created by an attacker. Attacker may use any legitimate site using Babel to redirect user to a URL of his/her choosing.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Babel

Browse Babel: Multilingual site / Babel
CVE ListAll versionsaffected

Nuclei templates

1
ProjectDiscoveryMEDIUMBabel - Open RedirectCVSS 6.1

Babel contains an open redirect vulnerability via redirect.php in the newurl parameter. An attacker can use any legitimate site using Babel to redirect user to a malicious site, thus possibly obtaining sensitive information, modifying data, and/or executing unauthorized operations.

Impact

An attacker can exploit this vulnerability to redirect users to malicious websites, leading to potential phishing attacks.

Remediation

Upgrade to Babel version 7.4.0 or later to mitigate this vulnerability.

WeaknessesCWE-601
Authors0x_Akoko
Template tagscve2019cveredirectbabelcmsmadesimplevuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:cmsmadesimple:bable\:multilingual_site:*:*:*:*:*:cms_made_simple:*:*
https://untrustednetwork.net/en/2019/02/20/open-redirection-vulnerability-in-babel/ http://dev.cmsmadesimple.org/project/files/729 https://nvd.nist.gov/vuln/detail/CVE-2019-1010290 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3