CVE-2020-22840

MEDIUMNuclei

b2evolution 6.11.6 - 'redirect_to' Open Redirect

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-22840 has a selected CVSS score of 6.1 (medium); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redirects to an attacker controlled resource via redirect_to parameter in email_passthrough.php.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBb2evolution 6.11.6 - 'redirect_to' Open RedirectExploitDB exploitby Nakul RattiNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMb2evolution CMS <6.11.6 - Open RedirectCVSS 6.1

b2evolution CMS before 6.11.6 contains an open redirect vulnerability via the redirect_to parameter in email_passthrough.php. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

This vulnerability can be exploited by attackers to trick users into visiting malicious websites, potentially leading to phishing attacks, malware infections, or unauthorized access to sensitive information.

Remediation

Upgrade b2evolution CMS to version 6.11.6 or later to mitigate the open redirect vulnerability (CVE-2020-22840).

WeaknessesCWE-601
Authorsgeeknik
Template tagscvecve2020packetstormedbredirectb2evolutionvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:b2evolution:b2evolution:*:*:*:*:*:*:*:*
https://github.com/b2evolution/b2evolution/issues/102 http://packetstormsecurity.com/files/161362/b2evolution-CMS-6.11.6-Open-Redirection.html https://www.exploit-db.com/exploits/49554 https://nvd.nist.gov/vuln/detail/CVE-2020-22840 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

4