Vulnerability · Published Aug 1, 2024 · Assigned by 1E
CVE-2024-7211The Duende Identity Server based component in 1E Platform may allow URL redirections to untrusted websites.
Medium 4.7
In plain English
A medium-severity open redirect in 1E Platform from 1E. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.2%top 84.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The 1E Platform's component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting an attacker to control the redirection path of end users. Note: 1E Platform's component utilizing the third-party Duende Identity Server has been updated with the patch that includes the fix.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| 1E | 1E Platform | 24.723.11.1.1523.7.1.808.4.1.229 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N