CVE-2023-6275

Deeper analysis

A vulnerability rated as problematic was identified in the TOTVS Fluig Platform versions 1.6.x, 1.7.x, 1.8.0, and 1.8.1. The issue resides in an unknown function of the file /mobileredir/openApp.jsp within the mobileredir component and stems from improper handling of the redirectUrl and user parameters. An attacker can supply a crafted input such as "><script>alert(document.domain)</script> to trigger reflected cross-site scripting, as classified under CWE-79. The flaw carries a CVSS 3.1 score of 3.5 and can be triggered remotely.

An authenticated user with low privileges can exploit the weakness by sending a malicious link or request to a victim who then interacts with the affected page, resulting in script execution in the victim's browser context. The attack requires user interaction and does not impact confidentiality or availability but can achieve limited integrity changes such as unauthorized script execution within the application's domain.

Vendor advisories direct administrators to upgrade to the fixed releases 1.7.1-231128, 1.8.0-231127, or 1.8.1-231127. The exploit code has been publicly disclosed, and the associated references include the TOTVS TDN release notes that document the remediation. The EPSS score has remained flat at its current and peak value of 0.5249 with no material increase observed after disclosure.