Cradle eCommerce Open Redirection Vulnerability
Vulnerability
An open redirection vulnerability has been identified in the latest demo version of the Cradle eCommerce platform. This issue arises in the login form endpoint, where the 'returnUrl' parameter is accepted without proper validation, allowing for unauthorized redirection. As a result, users can be misled from a legitimate website to external malicious pages without their awareness.
Impact
Exploitation of this vulnerability could lead to open redirection, allowing attackers to redirect users from a trusted site to a malicious one.
Remediation
The vulnerability has been fixed in the latest version of Cradle eCommerce.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.