Live › vulnerability › CVE-2024-2372
Some components build redirect URLs from user input without checking the destination, an open redirect. An attacker can send a link that appears to come from a trusted site and sends the victim to an attacker-controlled page for phishing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 11:22 UTC. All times on this page are UTC.
The sources do not name the affected product, versions or components, so the exposed systems cannot be identified. Teams should check their own web applications for redirect parameters that accept arbitrary external URLs once the vendor is identified.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.
By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.
This page as .md · .json · in your agent: get_signal("CVE-2024-2372")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.