Vulnerability · Published Aug 16, 2022 · Assigned by certcc
CVE-2022-25799An open redirect vulnerability exists in CERT/CC VINCE software prior to version 1.50.0
Medium 6.1
In plain English
A medium-severity open redirect in VINCE - The Vulnerability Information and Coordination Environment from CERT/CC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Official description
An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has a specially crafted URL and convince the user to click the link. When an authenticated user clicks the link, the authenticated user's browser could be redirected to a malicious site that is designed to impersonate a legitimate website. The attacker could trick the user and potentially acquire sensitive information such as the user's credentials.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CERT/CC | VINCE - The Vulnerability Information and Coordination Environment | 1.50.0 – before 1.50.0 |
Weakness: CWE-601