CVE-2021-20789 Open redirect in GroupSession
Remote attackers can redirect users to malicious sites via crafted URLs, facilitating phishing attacks against GroupSession users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-20789?
CVE-2021-20789 is a medium-severity vulnerability in Japan Total System Co.,Ltd. GroupSession, published on 28 Jul 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Open redirect vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0) allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack via a specially crafted URL.
Weakness: CWE-601
Which versions are affected by CVE-2021-20789?
It affects 3 products.
Products include Groupsession Groupsession, Groupsession Groupsession Bycloud, Groupsession Groupsession Zion.
How do I fix CVE-2021-20789?
No fix has been published for CVE-2021-20789 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-20789 being exploited?
There is no known exploitation of CVE-2021-20789 in the wild and no public exploit code.
Other vulnerabilities in Japan Total System Co.,Ltd. GroupSession
- CVE-2021-20874 Missing authorization in GroupSession Free edition, GroupSession byCloud, GroupSession ZION
- CVE-2025-61987 Cross-site request forgery in GroupSession Free edition
- CVE-2021-20876 Path traversal in GroupSession Free edition, GroupSession byCloud, GroupSession ZION
- CVE-2017-2165 Information disclosure in GroupSession
- CVE-2021-20875 Open redirect in GroupSession Free edition, GroupSession byCloud, GroupSession ZION
Sources
Also known as GHSA-pvpc-7x96-x9f5.