CVE-2017-20164

A vulnerability was found in Symbiote Seed up to 6.0.2. It has been classified as critical. Affected is the function onBeforeSecurityLogin of the file code/extensions/SecurityLoginExtension.php of the component Login. The manipulation of the argument URL leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 6.0.3 is able to address this issue. The patch is identified as b065ebd82da53009d273aa7e989191f701485244. It is recommended to upgrade the affected component. VDB-217626 is the identifier assigned to this vulnerability.
Configurations

Configuration 1 (hide)

cpe:2.3:a:symbiote:seed:*:*:*:*:*:silverstripe:*:*

History

21 Nov 2024, 03:22

Type Values Removed Values Added
References () https://github.com/symbiote/silverstripe-seed/commit/b065ebd82da53009d273aa7e989191f701485244 - Patch () https://github.com/symbiote/silverstripe-seed/commit/b065ebd82da53009d273aa7e989191f701485244 - Patch
References () https://github.com/symbiote/silverstripe-seed/releases/tag/6.0.3 - Release Notes () https://github.com/symbiote/silverstripe-seed/releases/tag/6.0.3 - Release Notes
References () https://vuldb.com/?ctiid.217626 - Third Party Advisory, VDB Entry () https://vuldb.com/?ctiid.217626 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?id.217626 - Third Party Advisory, VDB Entry () https://vuldb.com/?id.217626 - Third Party Advisory, VDB Entry
CVSS v2 : 6.5
v3 : 6.1
v2 : 6.5
v3 : 6.3

11 Apr 2024, 00:58

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en las versiones anteriores a la 6.0.2 de Symbiote Seed. Se ha clasificado como crítica. Se ve afectada por esta vulnerabilidad la función onBeforeSecurityLogin del archivo code/extensions/SecurityLoginExtension.php del componente Login. La manipulación del argumento URL conduce a una redirección abierta. Es posible lanzar el ataque de forma remota. La actualización a la versión 6.0.3 puede solucionar este problema. El parche se identifica como b065ebd82da53009d273aa7e989191f701485244. Se recomienda actualizar el componente afectado. VDB-217626 es el identificador asignado a esta vulnerabilidad.

24 Oct 2023, 20:22

Type Values Removed Values Added
CWE CWE-601
CPE cpe:2.3:a:symbiote:seed:*:*:*:*:*:*:*:* cpe:2.3:a:symbiote:seed:*:*:*:*:*:silverstripe:*:*
References (MISC) https://github.com/symbiote/silverstripe-seed/releases/tag/6.0.3 - Third Party Advisory (MISC) https://github.com/symbiote/silverstripe-seed/releases/tag/6.0.3 - Release Notes

20 Oct 2023, 12:15

Type Values Removed Values Added
CWE CWE-601
Summary A vulnerability was found in Symbiote Seed up to 6.0.2. It has been classified as critical. Affected is the function onBeforeSecurityLogin of the file code/extensions/SecurityLoginExtension.php of the component Login. The manipulation of the argument URL leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 6.0.3 is able to address this issue. The name of the patch is b065ebd82da53009d273aa7e989191f701485244. It is recommended to upgrade the affected component. VDB-217626 is the identifier assigned to this vulnerability. A vulnerability was found in Symbiote Seed up to 6.0.2. It has been classified as critical. Affected is the function onBeforeSecurityLogin of the file code/extensions/SecurityLoginExtension.php of the component Login. The manipulation of the argument URL leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 6.0.3 is able to address this issue. The patch is identified as b065ebd82da53009d273aa7e989191f701485244. It is recommended to upgrade the affected component. VDB-217626 is the identifier assigned to this vulnerability.

Information

Published : 2023-01-07 20:15

Updated : 2024-11-21 03:22


NVD link : CVE-2017-20164

Mitre link : CVE-2017-20164

CVE.ORG link : CVE-2017-20164


JSON object : View

Products Affected

symbiote

  • seed
CWE
CWE-601

URL Redirection to Untrusted Site ('Open Redirect')