Open Redirect Vulnerability in Seafile Server Software
CVE-2023-28874

6.1MEDIUM

Key Information:

Vendor

Seafile

Status
Seafile
Vendor
CVE Published:
9 December 2023

What is CVE-2023-28874?

An open redirect vulnerability has been identified in Seafile Server version 9.0.6. This flaw occurs at the '/accounts/login' endpoint, where it allows malicious actors to manipulate the next parameter, potentially redirecting users to arbitrary and potentially harmful external sites. This could lead to various security issues, including phishing attacks and exposure of sensitive user information. It is essential for users and administrators to apply necessary patches and mitigate risks associated with this vulnerability.

References

https://manual.seafile.com/changelog/server-changelog/#90...
https://herolab.usd.de/en/security-advisories/usd-2022-0033/

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.