CVE-2024-55452
A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulnerability allows authenticated attackers to redirect unprivileged users to an arbitrary, attacker-controlled webpage. When an authenticated user clicks on the malicious block item, they are redirected to the arbitrary untrusted domains, where sensitive tokens, such as JSON Web Tokens, can be stolen via a crafted webpage.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55452?
CVE-2024-55452 is classified as a medium severity vulnerability due to its potential impact on user trust and data security.
How do I fix CVE-2024-55452?
To fix CVE-2024-55452, ensure that URL validation is properly implemented in the upload and rendering processes within UJCMS.
Who can exploit CVE-2024-55452?
CVE-2024-55452 can be exploited by authenticated attackers who can leverage the URL redirection to direct unprivileged users to malicious sites.
What impacts does CVE-2024-55452 have on users?
Users affected by CVE-2024-55452 may be redirected to arbitrary, attacker-controlled webpages, potentially leading to phishing attacks or malware.
Which software versions are affected by CVE-2024-55452?
CVE-2024-55452 affects UJCMS version 9.6.3, allowing for exploitation through URL redirection vulnerabilities.