CVE-2020-21998

In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users

published April 27, 2021

CVSS
—
EPSS
1%
Percentile
70.6
In the wild
Unconfirmed
What it is

In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01319 · 70.6th percentile
Published
2021-04-27T17:46Z
EPSS history
Timeline
  • 27 APR 17:46Z
    In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users
    cvelistv5