Vulnerability · Published May 17, 2021 · Assigned by WPScan
CVE-2021-24288AcyMailing < 7.5.0 - Unauthenticated Open Redirect
Medium 6.1
In plain English
A medium-severity open redirect in Newsletter via SMTP, Sendinblue, Sendgrid, Mailgun - AcyMailing SMTP Newsletter from AcyMailing. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)1.9%top 19.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AcyMailing | Newsletter via SMTP, Sendinblue, Sendgrid, Mailgun - AcyMailing SMTP Newsletter | 7.5.0 – before 7.5.0 |
Weakness: CWE-601
References
- https://wpscan.com/vulnerability/56628862-1687-4862-9ed4-145d8dfbca97 x_refsource_CONFIRM