Vulnerability · Published Sep 9, 2024 · Assigned by twcert

CVE-2024-8586Uniong WebITR - Open Redirect

Medium 6.1

In plain English

A medium-severity open redirect in WebITR from Uniong. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.4%top 67.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WebITR from Uniong has an Open Redirect vulnerability, which allows unauthorized remote attackers to exploit this vulnerability to forge URLs. Users, believing they are accessing a trusted domain, can be redirected to another page, potentially leading to phishing attacks.

Affected products (as reported)

Vendor	Product	Versions
Uniong	WebITR	0 – through 2_1_0_27

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://www.twcert.org.tw/tw/cp-132-8043-cc323-1.html third-party-advisory
https://www.twcert.org.tw/en/cp-139-8044-65b84-2.html third-party-advisory