The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1.
References
Configurations
History
21 Nov 2024, 06:40
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 4.3 |
| References | () https://github.com/H4de5-7/vulnerabilities/blob/main/Ultimate%20Member%20%3C%3D%202.3.1%20-%20Open%20Redirect.md - Exploit, Third Party Advisory | |
| References | () https://github.com/ultimatemember/ultimatemember/issues/989 - Exploit, Issue Tracking, Third Party Advisory | |
| References | () https://github.com/ultimatemember/ultimatemember/pull/990 - Third Party Advisory | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/d638120b-5396-408b-8273-d003ff9dd01d?source=cve - | |
| References | () https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1209 - Third Party Advisory |
11 Jan 2024, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1. | |
| References |
|
|
| CWE |
Information
Published : 2022-05-10 20:15
Updated : 2024-11-21 06:40
NVD link : CVE-2022-1209
Mitre link : CVE-2022-1209
CVE.ORG link : CVE-2022-1209
JSON object : View
Products Affected
ultimatemember
- ultimate_member
CWE
No CWE.