What is GHSA-8m9j-2f32-2vx4?

GHSA-8m9j-2f32-2vx4 is a security advisory published by GitHub Security Advisories with Medium severity. MobSF vulnerable to Open Redirect in Login Redirect

Which CVE IDs does GHSA-8m9j-2f32-2vx4 cover?

GHSA-8m9j-2f32-2vx4 covers the following CVE IDs: CVE-2024-41955. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8m9j-2f32-2vx4?

GHSA-8m9j-2f32-2vx4 has a CVSS v3 base score of 5.2, published by GitHub Security Advisories.

Which products are affected by GHSA-8m9j-2f32-2vx4?

GHSA-8m9j-2f32-2vx4 affects 1 product, including: pip/mobsf:\u003c 4.0.5.

GHSA-8m9j-2f32-2vx4MediumCVSS 5.2

MobSF vulnerable to Open Redirect in Login Redirect

Vendor

GitHub Security Advisories

Published

July 31, 2024

Last Modified

August 2, 2024

🔗 CVE IDs covered (1)

CVE-2024-41955 →

📋 Description

Impact

What kind of vulnerability is it? Who is impacted?

An open redirect vulnerability exist in MobSF authentication view.

PoC

Go to http://127.0.0.1:8000/login/?next=//afine.com in a web browser.
Enter credentials and press "Sign In".
You will be redirected to afine.com

Users who are not using authentication are not impacted.

Patches

Has the problem been patched? What versions should users upgrade to?

Update to MobSF v4.0.5

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading? Disable Authentication

References

Are there any links users can visit to find out more? Fix: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/fdaad81314f393d324c1ede79627e9d47986c8c8