E621Ng
Monthly
Open redirect in e621ng before 26.09.16 lets remote attackers rewrite pagination and navigation links to attacker-controlled origins: query parameters named host, protocol, and port are handed to Rails' url_for, which treats them as URL-generation options rather than ordinary search filters, so the Previous/Next and numbered-page links rendered by PaginatorComponent, several controllers, and the search-trend views point at a malicious domain while the page itself still loads from the legitimate instance. No authentication is required (PR:N) and the assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so exploitation hinges on user interaction - the victim must open an attacker-supplied URL and then click a poisoned link, which is why the issue carries a modest CVSS 4.0 score of 5.3 and an assessed limited-severity rating. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor has released a fix in 26.09.16.
Open redirect in e621ng before 26.09.16 lets remote attackers rewrite pagination and navigation links to attacker-controlled origins: query parameters named host, protocol, and port are handed to Rails' url_for, which treats them as URL-generation options rather than ordinary search filters, so the Previous/Next and numbered-page links rendered by PaginatorComponent, several controllers, and the search-trend views point at a malicious domain while the page itself still loads from the legitimate instance. No authentication is required (PR:N) and the assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so exploitation hinges on user interaction - the victim must open an attacker-supplied URL and then click a poisoned link, which is why the issue carries a modest CVSS 4.0 score of 5.3 and an assessed limited-severity rating. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor has released a fix in 26.09.16.