CVE-2024-12990CWE-601

ruifang-tech Rebuild Admin Verification Page admin-verify redirect

Medium · published December 27, 2024

CVSS v4.0
5.3
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

A vulnerability was found in ruifang-tech Rebuild 3.8.6. It has been classified as problematic. This affects an unknown part of the file /user/admin-verify of the component Admin Verification Page. The manipulation of the argument nexturl with the input http://localhost/evil.html leads to open redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00345 · 26.7th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2024-12-27T18:00Z
EPSS history
Timeline
  • 27 DEC 18:00Z
    ruifang-tech Rebuild Admin Verification Page admin-verify redirect
    cvelistv5