CVE-2021-24288 AcyMailing < 7.5.0 - Unauthenticated Open Redirect

2021-05-1716:48:52

CWE-601

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

49.5%

JSON

When subscribing using AcyMailing, the ‘redirect’ parameter isn’t properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim.

CNA Affected

[
  {
    "product": "Newsletter via SMTP, Sendinblue, Sendgrid, Mailgun - AcyMailing SMTP Newsletter",
    "vendor": "AcyMailing",
    "versions": [
      {
        "lessThan": "7.5.0",
        "status": "affected",
        "version": "7.5.0",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/56628862-1687-4862-9ed4-145d8dfbca97

0.001 Low

EPSS

Percentile

49.5%

JSON

Related for CVELIST:CVE-2021-24288