CVE-2024-47530 Scout contains an Open Redirect on Login via `next`
Attackers can redirect users to malicious sites via the login next parameter, enabling phishing and HTTPS downgrade attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-47530?
CVE-2024-47530 is a medium-severity vulnerability in Clinical-Genomics scout, published on 30 Sep 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Scout is a web-based visualizer for VCF-files. Open redirect vulnerability allows performing phishing attacks on users by redirecting them to malicious page. /login API endpoint is vulnerable to open redirect attack via next parameter due to absence of sanitization logic. Additionally, due to lack of scheme validation, HTTPS Downgrade Attack can be performed on the users. This vulnerability is fixed in 4.89.
Weakness: CWE-601
Which versions are affected by CVE-2024-47530?
It affects 1 product.
Products include Clinical-Genomics Scout.
How do I fix CVE-2024-47530?
Upgrade to a fixed version.
Is CVE-2024-47530 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47530 exists.
Other vulnerabilities in Clinical-Genomics scout
Sources
Also known as GHSA-3x45-2m34-x95v.