CVE-2023-26494mediumCWE-601

CVE-2023-26494: falha de média gravidade em TheThingsNetwork lorawan-stack

lorawan-stack has open redirect vulnerability

Publicada em 24 abr 2023 · Atualizada em 04 fev 2025

Seguir esta CVE + Monitorar lorawan-stack + Monitorar go.thethings.network/lorawan-stack

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 0.6%

lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Produtos afetados

TheThingsNetwork · lorawan-stack

Referências

https://github.com/TheThingsNetwork/lorawan-stack/blob/ecdef730f176c02f7c9afce98b0457ae64de5bfc/pkg/webui/account/views/login/index.js#L90-L90 https://github.com/TheThingsNetwork/lorawan-stack/blob/ecdef730f176c02f7c9afce98b0457ae64de5bfc/pkg/webui/account/views/token-login/index.js#L74-L74 https://github.com/TheThingsNetwork/lorawan-stack/commit/f06776028bdb3994847fc6067613dc61a2b3559e https://github.com/TheThingsNetwork/lorawan-stack/releases/tag/v3.24.1 https://securitylab.github.com/advisories/GHSL-2022-138_lorawan-stack/