CVE-2024-55452

A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulnerability allows authenticated attackers to redirect unprivileged users to an arbitrary, attacker-controlled webpage. When an authenticated user clicks on the malicious block item, they are redirected to the arbitrary untrusted domains, where sensitive tokens, such as JSON Web Tokens, can be stolen via a crafted webpage.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/OpenRedirect-BlockItemUpload.md	Exploit Third Party Advisory
https://github.com/dromara/ujcms	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:ujcms:ujcms:9.6.3:*:*:*:*:*:*:*

History

24 Apr 2025, 15:20

Type	Values Removed	Values Added
References	~~() https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/OpenRedirect-BlockItemUpload.md -~~	() https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/OpenRedirect-BlockItemUpload.md - Exploit, Third Party Advisory
References	~~() https://github.com/dromara/ujcms -~~	() https://github.com/dromara/ujcms - Product
CPE		cpe:2.3:a:ujcms:ujcms:9.6.3:::::::*
First Time		Ujcms Ujcms ujcms

17 Dec 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-16 23:15

Updated : 2025-04-24 15:20

NVD link : CVE-2024-55452

Mitre link : CVE-2024-55452

CVE.ORG link : CVE-2024-55452

JSON object : View

Products Affected

ujcms

ujcms

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2024-55452", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2024-12-16T23:15:06.817", "references": [{"url": "https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/OpenRedirect-BlockItemUpload.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/dromara/ujcms", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulnerability allows authenticated attackers to redirect unprivileged users to an arbitrary, attacker-controlled webpage. When an authenticated user clicks on the malicious block item, they are redirected to the arbitrary untrusted domains, where sensitive tokens, such as JSON Web Tokens, can be stolen via a crafted webpage."}, {"lang": "es", "value": "Existe una vulnerabilidad de redirecci\u00f3n de URL en UJCMS 9.6.3 debido a una validaci\u00f3n incorrecta de las URL en la carga y representaci\u00f3n de nuevos elementos de bloque/carrusel. Esta vulnerabilidad permite a los atacantes autenticados redirigir a usuarios sin privilegios a una p\u00e1gina web arbitraria controlada por el atacante. Cuando un usuario autenticado hace clic en el elemento de bloque malicioso, se lo redirige a dominios arbitrarios que no son de confianza, donde se pueden robar tokens confidenciales, como tokens web JSON, a trav\u00e9s de una p\u00e1gina web manipulada."}], "lastModified": "2025-04-24T15:20:21.370", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ujcms:ujcms:9.6.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B35595EB-DB23-45CE-B865-658935EAE1D3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}