Vulnerability · Published Aug 12, 2022 · Assigned by GitHub_M
CVE-2022-35953URL Redirection to Untrusted Site ('Open Redirect') in bookwyrm
High 7.1
In plain English
A high-severity open redirect in bookwyrm from bookwyrm-social. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.6%top 49.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
BookWyrm is a social network for tracking your reading, talking about books, writing reviews, and discovering what to read next. Some links in BookWyrm may be vulnerable to tabnabbing, a form of phishing that gives attackers an opportunity to redirect a user to a malicious site. The issue was patched in version 0.4.5.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bookwyrm-social | bookwyrm | < 0.4.5 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:H
References
- https://github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-xq42-mq5w-m24x x_refsource_CONFIRM
- https://huntr.dev/bounties/67ca22bd-19c6-466b-955a-b1ee2da0c575/ x_refsource_MISC