Lucene search

TwcertCVELIST:CVE-2020-24551

HistoryOct 14, 2020 - 12:45 p.m.

CVE-2020-24551 IProom MMC+ Server - URL Redirection to Untrusted Site (Open Redirect')

2020-10-1412:45:16

CWE-601

twcert

www.cve.org

iproom mmc+ server

url redirection

untrusted site

open redirect

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

33.8%

JSON

IProom MMC+ Server login page does not validate specific parameters properly. Attackers can use the vulnerability to redirect to any malicious site and steal the victim’s login credentials.

CNA Affected

[
  {
    "product": "MMC+ Server",
    "vendor": "IProom",
    "versions": [
      {
        "lessThanOrEqual": "3.2.2",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-4053-6e9a2-1.html

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

33.8%

JSON

Related for CVELIST:CVE-2020-24551