Vulnerability · Published Feb 28, 2023 · Assigned by tenable

CVE-2023-27292

Medium 5.4

In plain English

A medium-severity open redirect in OpenCATS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)1.0%top 36.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters.

Affected products (as reported)

Vendor	Product	Versions
n/a	OpenCATS	0.9.6

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://www.tenable.com/security/research/tra-2023-8