CVE-2021-24288: AcyMailing < 7.5.0 - Unauthenticated Open Redirect
When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2021-24288.
What is the title of this vulnerability?
The title of this vulnerability is 'When subscribing using AcyMailing the redirect parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim.'
How does this vulnerability affect AcyMailing?
This vulnerability affects AcyMailing when subscribing.
What is the severity of CVE-2021-24288?
The severity of CVE-2021-24288 is medium with a CVSS score of 6.1.
How can this vulnerability be fixed?
To fix this vulnerability, users should update AcyMailing to version 7.5.1 or later and ensure that input validation and sanitization are properly implemented.