Open Redirect

2024-03-1306:06:30

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

open redirect

authentication

validation

redirect parameter

phishing

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

AI Score

7.2

Confidence

Low

EPSS

Percentile

15.5%

JSON

directus is vulnerable to Open Redirect. This vulnerability is due to the lack of validation of the ‘redirect’ parameter in the authentication API, which can get exploited during the login process by redirecting users to a malicious site. Users can be tricked into divulging their passwords through phishing attacks.