2021-04-02 08:41:43 +00:00
id : CVE-2020-24550
info :
name : CVE-2020-24550
author : dhiyaneshDK
severity : medium
2021-04-02 09:01:43 +00:00
description : An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect users to untrusted websites via the _t_redirect parameter in a crafted URL, such as a /find_v2/_click URL.
tags : cve,cve2020,redirect,episerver
2021-04-04 09:49:07 +00:00
reference : https://labs.nettitude.com/blog/cve-2020-24550-open-redirect-in-episerver-find/
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score : 6.10
cve-id : CVE-2020-24550
cwe-id : CWE-601
2021-04-02 08:41:43 +00:00
requests :
- method : GET
path :
2021-04-02 09:01:43 +00:00
- '{{BaseURL}}/find_v2/_click?_t_id=&_t_q=&_t_hit.id=&_t_redirect=https://example.com'
2021-04-02 08:41:43 +00:00
matchers-condition : and
matchers :
- type : word
words :
2021-04-02 09:01:43 +00:00
- "Location: https://example.com"
2021-04-02 08:41:43 +00:00
part : header
- type : status
status :
- 301
