CVE-2021-24288CWE-601

AcyMailing < 7.5.0 - Unauthenticated Open Redirect

published May 17, 2021

CVSS
—
EPSS
2%
Percentile
80.0
In the wild
Unconfirmed
What it is

When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01939 · 80.0th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2021-05-17T16:48Z
EPSS history
Timeline
  • 17 MAY 16:48Z
    AcyMailing < 7.5.0 - Unauthenticated Open Redirect
    cvelistv5