CVE-2024-31213 InstantCMS Open Redirect vulnerability
Attackers can redirect users to malicious sites after profile updates, potentially stealing credentials via phishing pages.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-31213?
CVE-2024-31213 is a low-severity vulnerability in instantsoft icms2, published on 5 Apr 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are still present on the ICMS2 application. They could then host a website stating "To update your profile, please enter your password," upon which the user may type their password and send it to the attacker. As of time of publication, a patched version is not available.
Weakness: CWE-601
Which versions are affected by CVE-2024-31213?
It affects 1 product.
Products include Instantcms Instantcms.
How do I fix CVE-2024-31213?
No fix has been published for CVE-2024-31213 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-31213 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-31213 exists.
Other vulnerabilities in instantsoft icms2
- CVE-2023-4188 SQL Injection in instantsoft/icms2
- CVE-2013-10051 InstantCMS <= 1.6 Remote PHP Code Execution
- CVE-2023-4704 External Control of System or Configuration Setting in instantsoft/icms2
- CVE-2026-28281 InstantCMS has Multiple CSRF Vulnerabilities
- CVE-2023-4652 Cross-site Scripting (XSS) - Stored in instantsoft/icms2
Sources
Also known as GHSA-6v3c-p92q-prfq.