UNKNOWNCVE-2024-58342

XenForo Open Redirect via getDynamicRedirect

Platform

php

Component

xenforo

Fixed in

2.3.1

XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL. The getDynamicRedirect() function does not adequately validate the redirect target, allowing attackers to redirect users to arbitrary external sites using crafted URLs containing newlines, user credentials, or host mismatches.

How to fix

Actualice XenForo a la versión 2.2.17 o 2.3.1, o superior, para corregir la vulnerabilidad de redirección abierta. Esto evitará que los atacantes redirijan a los usuarios a sitios externos maliciosos a través de URLs manipuladas.

Monitor your dependencies automatically

Get notified when new vulnerabilities affect your projects. Free forever.

Start free