CVE-2024-2372: Medium severity vulnerability
The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.
By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to craft a link containing a malicious redirection URL and persuade a user to click it. No attacker authentication or special privileges are indicated.
Who is exposed to the greatest risk?
Users who can be induced to follow attacker-supplied links are exposed to phishing or other social-engineering attacks. The impact depends on the user interacting with the crafted link.
What are the likely consequences of exploitation?
A successful exploit redirects the user to an arbitrary attacker-controlled external domain. This can make phishing pages appear more credible and may lead to disclosure of sensitive information.