CVE-2022-0692
published 2022-02-21CVE-2022-0692: Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.
PriorityP334medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
3.38%
87.3th percentile
Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| alltube_project | alltube | < 3.0.1 | 3.0.1 |
| rudloff | alltube | >= 0 < 3.0.1 | 3.0.1 |
| rudloff | rudloff_alltube | >= unspecified < 3.0.1 | 3.0.1 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv3.04.7MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
ghsa6.1MEDIUM
osv6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Open Redirect in AllTube
osv·2022-02-23·CVSS 6.1
CVE-2022-0692 [MEDIUM] Open Redirect in AllTube
Open Redirect in AllTube
### Impact
Releases prior to 3.0.1 are vulnerable to an open redirect vulnerability that allows an attacker to construct a URL that redirects to an arbitrary external domain.
### Patches
3.0.1 contains a fix for this vulnerability.
(The 1.x and 2.x releases are not maintained anymore.)
### References
* https://github.com/rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a
* https://huntr.dev/bounties/4fb39400-e08b-47af-8c1f-5093c9a51203/
* https://nvd.nist.gov/vuln/detail/CVE-2022-0692
GHSA
Open Redirect in AllTube
ghsa·2022-02-23·CVSS 6.1
CVE-2022-0692 [MEDIUM] CWE-601 Open Redirect in AllTube
Open Redirect in AllTube
### Impact
Releases prior to 3.0.1 are vulnerable to an open redirect vulnerability that allows an attacker to construct a URL that redirects to an arbitrary external domain.
### Patches
3.0.1 contains a fix for this vulnerability.
(The 1.x and 2.x releases are not maintained anymore.)
### References
* https://github.com/rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a
* https://huntr.dev/bounties/4fb39400-e08b-47af-8c1f-5093c9a51203/
* https://nvd.nist.gov/vuln/detail/CVE-2022-0692
No detection rules found.
Nuclei
Rudloff alltube prior to 3.0.1 - Open Redirect
nuclei·CVSS 6.1
CVE-2022-0692 [MEDIUM] Rudloff alltube prior to 3.0.1 - Open Redirect
Rudloff alltube prior to 3.0.1 - Open Redirect
An open redirect vulnerability exists in Rudloff/alltube that could let an attacker construct a URL within the application that causes redirection to an arbitrary external domain via Packagist in versions prior to 3.0.1.
Template:
id: CVE-2022-0692
info:
name: Rudloff alltube prior to 3.0.1 - Open Redirect
author: 0x_Akoko
severity: medium
description: An open redirect vulnerability exists in Rudloff/alltube that could let an attacker construct a URL within the application that causes redirection to an arbitrary external domain via Packagist in versions prior to 3.0.1.
impact: |
An attacker can exploit this vulnerability to redirect users to malicious websites, leading to potential phishing attacks or the download of malware.
remediation:
No writeups or analysis indexed.
2022-02-21
Published