CVE-2024-21641 PoC — Flarum 输入验证错误漏洞

来源

关联漏洞

Description

Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation.

文件快照

 id: CVE-2024-21641

info:
  name: Flarum < 1.8.5 - Open Redirect
  author: kking
  severity: medium


...

备注