CVE-2024-55452

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-55452

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-55452.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-55452

Published

2024-12-16T00:00:00Z

Modified

2026-08-12T03:51:49Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulnerability allows authenticated attackers to redirect unprivileged users to an arbitrary, attacker-controlled webpage. When an authenticated user clicks on the malicious block item, they are redirected to the arbitrary untrusted domains, where sensitive tokens, such as JSON Web Tokens, can be stolen via a crafted webpage.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55452.json"
}

References

Affected packages

Git / github.com/dromara/ujcms

Affected ranges

Type

GIT

Repo

https://github.com/dromara/ujcms

Events

Introduced

4912aab3df20c76340505829f37f660be94def39

Last Affected

4912aab3df20c76340505829f37f660be94def39

Database specific

Show details

{
    "cpe": "cpe:2.3:a:ujcms:ujcms:9.6.3:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "9.6.3"
        },
        {
            "last_affected": "9.6.3"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

9.*

9.6.3

v9.*

v9.6.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-55452.json"