CVE-2021-24288

MEDIUMNuclei

AcyMailing < 7.5.0 - Unauthenticated Open Redirect

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24288 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Newsletter via SMTP, Sendinblue, Sendgrid, Mailgun - AcyMailing SMTP Newsletter

Browse AcyMailing / Newsletter via SMTP, Sendinblue, Sendgrid, Mailgun - AcyMailing SMTP Newsletter
CVE List7.5.0 to < 7.5.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress AcyMailing <7.5.0 - Open RedirectCVSS 6.1

WordPress AcyMailing plugin before 7.5.0 contains an open redirect vulnerability due to improper sanitization of the redirect parameter. An attacker turning the request from POST to GET can craft a link containing a potentially malicious landing page and send it to the user.

Impact

An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the installation of malware.

Remediation

Update the AcyMailing plugin to version 7.5.0 or later to fix the open redirect vulnerability.

WeaknessesCWE-601
Authors0x_Akoko
Template tagscvecve2021wpscanwordpressredirectwp-pluginacymailingvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:acymailing:acymailing:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/56628862-1687-4862-9ed4-145d8dfbca97 https://nvd.nist.gov/vuln/detail/CVE-2021-24288 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2