Vulnerability · Published Nov 15, 2024 · Assigned by @huntr_ai
CVE-2024-1240Open Redirection in pyload/pyload
Medium 4.6
In plain English
A medium-severity open redirect in pyload/pyload from pyload. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)4.6Medium
Exploit odds (30 days)0.3%top 72.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which can be used for phishing or other malicious activities. The issue is fixed in pyload-ng 0.5.0b3.dev79.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | pyload-ng | no fix listed | PYSEC-2024-123 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pyload | pyload/pyload | unspecified – before pyload-ng 0.5.0b3.dev79 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L