CVE-2023-34020
Published: 27 March 2024
Summary
CVE-2023-34020 is a medium-severity Open Redirect (CWE-601) vulnerability in Uncannyowl Uncanny Toolkit For Learndash. Its CVSS base score is 4.7 (Medium).
Operationally, ranked in the top 8.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-34020 is an open redirect vulnerability (CWE-601) affecting the Uncanny Toolkit for LearnDash WordPress plugin developed by Uncanny Owl. The flaw exists in all versions through 3.6.4.3 and carries a CVSS 3.1 score of 4.7, reflecting network attack vector, low complexity, no required privileges, and required user interaction with changed scope but limited confidentiality impact.
An unauthenticated remote attacker can supply a crafted URL that causes the plugin to redirect a victim user to an arbitrary external site. Because the redirect occurs in a trusted context, the attacker can leverage it for phishing or to deliver malicious content while the victim believes they remain on the original LearnDash site.
The vulnerability is tracked in the Patchstack database, which identifies the affected plugin versions and indicates that the issue is resolved by updating beyond 3.6.4.3. The associated EPSS score has remained flat at 0.0730 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-38144
Vulnerability details
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.