CVE-2018-1000671

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-09-06 · updated 2026-06-17
Weakness: CWE-601

Description

sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.

Affected products

Debian Linux: 8.0
Sympa: from 6.2.16

References

https://github.com/sympa-community/sympa/issues/268
https://lists.debian.org/debian-lts-announce/2018/09/msg00023.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00015.html
https://usn.ubuntu.com/4442-1/
https://github.com/sympa-community/sympa/issues/268
https://lists.debian.org/debian-lts-announce/2018/09/msg00023.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00015.html
https://usn.ubuntu.com/4442-1/

Get alerted when CVE-2018-1000671 or the next vulnerability affects your stack