VulnerabilityAnalyzed

CVE-2024-1240

An open redirection vulnerability exists in pyload/pyload version 0.5.0.

MEDIUM 6.1EPSS 0.33%

Does this matter?

Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own.

Description

An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which can be used for phishing or other malicious activities. The issue is fixed in pyload-ng 0.5.0b3.dev79.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.33% probability · 26th percentile
CISA KEV: Not listed
Weakness: CWE-601
Affected: pyload/pyload
Source: security@huntr.dev

References

https://github.com/pyload/pyload/commit/fe94451dcc2be90b3889e2fd9d07b483c8a6dccdPatch
https://huntr.com/bounties/eef9513d-ccc3-4030-b574-374c5e7b887eExploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.