CVE-2017-20164
Symbiote Seed Login SecurityLoginExtension.php onBeforeSecurityLogin redirect
Also known as GHSA-wm32-3r4m-jvcc
Published 3 y ago · modified 4 mo ago · JSON
Summary
A vulnerability was found in Symbiote Seed up to 6.0.2. It has been classified as critical. Affected is the function onBeforeSecurityLogin of the file code/extensions/SecurityLoginExtension.php of the component Login. The manipulation of the argument URL leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 6.0.3 is able to address this issue. The patch is identified as b065ebd82da53009d273aa7e989191f701485244. It is recommended to upgrade the affected component. VDB-217626 is the identifier assigned to this vulnerability.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction (EPSS)
0.54% probability of exploitation in the next 30 days, higher than 46% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 6.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | symbiote/silverstripe-seed | <6.0.3 | 6.0.3 |
Affected products
- Symbiote Seed
Classification
- Weakness
- CWE-601 URL Redirection to Untrusted Site
References
- vuldb.com /?id.217626 · vdb-entry, technical-description, x_transferred
- vuldb.com /?ctiid.217626 · signature, permissions-required, x_transferred
- github.com /symbiote/silverstripe-seed/commit/b065ebd82da53009d273aa7e989191f701485244 · patch, x_transferred
- github.com /symbiote/silverstripe-seed/releases/tag/6.0.3 · patch, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-20164 · advisory
- github.com /symbiote/silverstripe-seed · package
Sources
- CVE List: CVE-2017-20164
- GitHub Advisory: GHSA-wm32-3r4m-jvcc
- NVD: CVE-2017-20164
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.