CVE-2023-5375
Published: 04 October 2023
Summary
CVE-2023-5375 is a medium-severity Open Redirect (CWE-601) vulnerability in Mosparo Mosparo. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 2.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-5375 is an open redirect vulnerability, categorized under CWE-601, that affects the mosparo GitHub repository prior to version 1.0.2. The flaw received a CVSS v3.1 score of 6.1 with a vector indicating network attack vector, low attack complexity, no required privileges, required user interaction, and changed scope, resulting in limited impacts to confidentiality and integrity.
An unauthenticated attacker can exploit the issue by crafting a malicious URL that causes the application to redirect a victim user to an arbitrary external site. Successful exploitation could facilitate phishing or other social-engineering attacks that leverage the trust associated with the mosparo domain.
The referenced GitHub commit and huntr.dev bounty report document the fix that was merged to address the redirect logic; users are therefore advised to upgrade to mosparo 1.0.2 or later. The EPSS score reached a peak of 0.4921 and currently stands at 0.4330, indicating moderate and relatively stable exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-57691
Vulnerability details
Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.