CVE-2024-55452

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-55452
A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulnerability allows authenticated attackers to redirect unprivileged users to an arbitrary, attacker-controlled webpage. When an authenticated user clicks on the malicious block item, they are redirected to the arbitrary untrusted domains, where sensitive tokens, such as JSON Web Tokens, can be stolen via a crafted webpage.
CVSS

No CVSS.

References
Link Resource
https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/OpenRedirect-BlockItemUpload.md Exploit Third Party Advisory
https://github.com/dromara/ujcms Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:ujcms:ujcms:9.6.3:*:*:*:*:*:*:*
History

24 Apr 2025, 15:20

Type Values Removed Values Added
References () https://github.com/dromara/ujcms - () https://github.com/dromara/ujcms - Product
References () https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/OpenRedirect-BlockItemUpload.md - () https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/OpenRedirect-BlockItemUpload.md - Exploit, Third Party Advisory
First Time Ujcms
Ujcms ujcms
CPE cpe:2.3:a:ujcms:ujcms:9.6.3:*:*:*:*:*:*:*

16 Dec 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-16 23:15

Updated : 2025-04-24 15:20

NVD link : CVE-2024-55452

Mitre link : CVE-2024-55452

JSON object : View

Products Affected

ujcms

  • ujcms
CWE

No CWE.