| Reporter | Title | Published | Views | Family All 18 |
|---|---|---|---|---|
| Security Bulletin: ITNM is vulnerable to redirect vulnerabilities due to use of nitely/spirit libraries prior to 0.12.3 (CVE-2022-0869) | 5 Jan 202315:17 | – | ibm | |
| CVE-2022-0869 | 6 Mar 202210:15 | – | attackerkb | |
| Github spirit 输入验证错误漏洞 | 6 Mar 202200:00 | – | cnnvd | |
| Github spirit input validation error vulnerability | 8 Mar 202200:00 | – | cnvd | |
| CVE-2022-0869 | 6 Mar 202209:20 | – | cve | |
| CVE-2022-0869 Multiple Open Redirect in nitely/spirit | 6 Mar 202209:20 | – | cvelist | |
| Multiple Open Redirect | 21 Feb 202200:52 | – | huntr | |
| EUVD-2022-1327 | 3 Oct 202520:07 | – | euvd | |
| Open Redirect in django-spirit | 7 Mar 202200:00 | – | github | |
| CVE-2022-0869 | 6 Mar 202210:15 | – | nvd |
id: CVE-2022-0869
info:
name: nitely/spirit 0.12.3 - Open Redirect
author: ctflearner
severity: medium
description: |
Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3.
impact: |
An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the theft of sensitive information.
remediation: |
Upgrade to a patched version of nitely/spirit to mitigate the open redirect vulnerability (CVE-2022-0869).
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2022-0869
- https://huntr.dev/bounties/ed335a88-f68c-4e4d-ac85-f29a51b03342
- https://github.com/nitely/spirit/commit/8f32f89654d6c30d56e0dd167059d32146fb32ef
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2022-0869
cwe-id: CWE-601
epss-score: 0.0262
epss-percentile: 0.83679
cpe: cpe:2.3:a:spirit-project:spirit:*:*:*:*:*:*:*:*
metadata:
max-request: 4
vendor: spirit-project
product: spirit
tags: cve,cve2022,huntr,redirect,nitely,spirit,spirit-project,vuln
http:
- method: GET
path:
- "{{BaseURL}}/user/login/?next=https%3A%2F%2Finteract.sh"
- "{{BaseURL}}/user/logout?next=https%3A%2F%2Finteract.sh"
- "{{BaseURL}}/user/register?next=https%3A%2F%2Finteract.sh"
- "{{BaseURL}}/user/resend-activation?next=https%3A%2F%2Finteract.sh"
stop-at-first-match: true
matchers:
- type: regex
part: header
regex:
- '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'
# digest: 490a0046304402200b8fa4ad6bd2c4982fdd170f3fd349403429e2dc597801a46ce2f584ea7bbac102205f6004dcb86c10d902b20d768629af8c12ec62824586a721651cb336611393e2:922c64590222798bb761d5b6d8e72950Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation