Zipline before 4.5.0 Stored Open Redirect via POST /api/user/urls
Summary
Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled URLs as destinations, causing visitors o...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| dicedzipline |
< 4.5.0→ 4.5.0 |
4.5.0 |
Original description The description as published by the source.
Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled URLs as destinations, causing visitors of the trusted short link to be redirected to phishing or malware pages.
Source: CVE.org (CVE Program・cvelistV5) NVD