Elgg up to 1.12.17/2.3.10 redirect

Summaryinfo

A vulnerability classified as problematic has been found in Elgg up to 1.12.17/2.3.10. This vulnerability affects unknown code. Performing a manipulation results in redirect. This vulnerability is known as CVE-2019-11016. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Elgg up to 1.12.17/2.3.10. It has been classified as critical. This affects some unknown processing. The manipulation with an unknown input leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect.

The bug was discovered 04/04/2019. The weakness was published 04/08/2019. This vulnerability is uniquely identified as CVE-2019-11016 since 04/08/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 1.12.18 or 2.3.11 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Elgg

Version

• 1.12.0
• 1.12.1
• 1.12.2
• 1.12.3
• 1.12.4
• 1.12.5
• 1.12.6
• 1.12.7
• 1.12.8
• 1.12.9
• 1.12.10
• 1.12.11
• 1.12.12
• 1.12.13
• 1.12.14
• 1.12.15
• 1.12.16
• 1.12.17
• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 2.3.8
• 2.3.9
• 2.3.10

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion