CVE-2024-46481

High

Published: 13 January 2025

Published

13 January 2025

Modified

03 October 2025

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Score 0.0020 42.0th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-46481 is a high-severity Open Redirect (CWE-601) vulnerability in Venki Supravizio Bpm. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Web Portal Capture (T1056.003); ranked at the 42.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Web Portal Capture (T1056.003) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Requires validation of untrusted inputs like redirect parameters on the login page to block malicious open redirects that chain to reflected XSS.

SI-15 Information Output Filtering good match

prevent

Mandates filtering and encoding of output on the login page to prevent execution of reflected XSS payloads triggered by the open redirect.

SI-2 Flaw Remediation good match

prevent

Directs timely identification, reporting, and correction of software flaws such as this open redirect-to-XSS vulnerability in Venki Supravizio BPM.

MITRE ATT&CK Enterprise TechniquesAI

T1056.003 Web Portal Capture Collection

Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

T1566.002 Spearphishing Link Initial Access

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.

attack.mitre.org →

Why these techniques?

Open redirect on login page facilitates spearphishing links (T1566.002); reflected XSS enables JavaScript execution (T1059.007) and credential capture from the web login portal (T1056.003).

NVD Description

The login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS.

Deeper analysisAI

CVE-2024-46481 is an open redirect vulnerability in the login page of Venki Supravizio BPM versions up to 18.1.1, which can be chained to enable reflected cross-site scripting (XSS). This issue falls under CWE-601 and carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and scope change with low impacts on confidentiality and integrity.

The vulnerability can be exploited by unauthenticated attackers with network access to the affected login page. Exploitation involves crafting a malicious redirect URL that, when processed, leads to reflected XSS execution in the victim's browser, potentially allowing limited theft of sensitive data like login credentials or session information without requiring user privileges.

Mitigation details are available in the referenced advisories, including the research disclosure at https://github.com/Lorenzo-de-Sa/Vulnerability-Research/blob/main/CVE-2024-46481.md and the vendor's Supravizio page at https://www.venki.com.br/ferramenta-bpm/supravizio/. Security practitioners should consult these for patching instructions or workarounds specific to Venki Supravizio BPM.