Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Open Redirect Vulnerability in Loading Page in bunkerweb
Vulnerability Description
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated "next" parameter for redirects. Ex. visiting: `/loading?next=https://google.com` while authenticated will cause the page will redirect to google.com. This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites. This issue has been addressed in version 1.5.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Information
N/A
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Vulnerability Title
bunkerweb 输入验证错误漏洞
Vulnerability Description
BunkerWeb是Bunkerity开源的一个开源 Web 应用程序防火墙。 bunkerweb 1.5.11及之前版本存在输入验证错误漏洞，该漏洞源于存在开放重定向漏洞，允许攻击者通过next参数将经过身份验证的用户重定向到任意外部URL。
CVSS Information
N/A
Vulnerability Type
N/A