Cyber Resilience

CVE-2023-5375

MediumPublic PoC

Published: 04 October 2023

Published
04 October 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score 0.4330 97.6th percentile
Risk Priority 38 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-5375 is a medium-severity Open Redirect (CWE-601) vulnerability in Mosparo Mosparo. Its CVSS base score is 6.1 (Medium).

Operationally, ranked in the top 2.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2023-5375 is an open redirect vulnerability, categorized under CWE-601, that affects the mosparo GitHub repository prior to version 1.0.2. The flaw received a CVSS v3.1 score of 6.1 with a vector indicating network attack vector, low attack complexity, no required privileges, required user interaction, and changed scope, resulting in limited impacts to confidentiality and integrity.

An unauthenticated attacker can exploit the issue by crafting a malicious URL that causes the application to redirect a victim user to an arbitrary external site. Successful exploitation could facilitate phishing or other social-engineering attacks that leverage the trust associated with the mosparo domain.

The referenced GitHub commit and huntr.dev bounty report document the fix that was merged to address the redirect logic; users are therefore advised to upgrade to mosparo 1.0.2 or later. The EPSS score reached a peak of 0.4921 and currently stands at 0.4330, indicating moderate and relatively stable exploitation interest since disclosure.

EU & UK References

Vulnerability details

Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

mosparo
mosparo
≤ 1.0.2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-601

Security awareness includes verifying URLs and avoiding untrusted redirects that lead to malicious sites.

addresses: CWE-601

Validates redirect targets and URLs to ensure they conform to allowed destinations.

References