CVE-2024-7211 The Duende Identity Server based component in 1E Platform may allow URL redirections to untrusted websites.
An open redirect vulnerability in the Duende Identity Server component allows attackers to redirect users to untrusted websites.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-7211?
CVE-2024-7211 is a medium-severity vulnerability in 1E Platform, published on 1 Aug 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The 1E Platform's component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting an attacker to control the redirection path of end users.
Note: 1E Platform's component utilizing the third-party Duende Identity Server has been updated with the patch that includes the fix.
Weakness: CWE-601
Which versions are affected by CVE-2024-7211?
It affects 1 product.
Products include 1e Platform.
How do I fix CVE-2024-7211?
No fix has been published for CVE-2024-7211 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-7211 being exploited?
There is no known exploitation of CVE-2024-7211 in the wild and no public exploit code.
Other vulnerabilities in 1E Platform
- CVE-2023-45161 1E-Exchange-URLResponseTime instruction before v20.1 allows arbitrary code execution
- CVE-2023-45163 1E-Exchange-CommandLinePing instruction before v18.1 allows for arbitrary code execution
- CVE-2023-5964 1E-Exchange-DisplayMessage instruction allows for arbitrary code execution
- CVE-2023-45162 Blind SQL vulnerability in 1E platform
- CVE-2025-1683 Symbolic Link Exploit in 1E Client's - Nomad module allows Arbitrary File Deletion
Sources
Also known as GHSA-62gh-q5g8-jv59.