Open Redirect in Cainor Calendarinho
CVE-2023-49281
Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites, potentially leading to information theft and reputational damage to the website used for redirection. The problem is has been patched in commit `15b2393`. Users are advised to update to a commit after `15b2393`. There are no known workarounds for this vulnerability.
Vulnerability class: Open Redirect
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.006 (44.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 44.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Cainor Calendarinho — versions < 15b2393
Weakness classification (CWE)
References
- github.com/Cainor/Calendarinho/security/advisories/GHSA-g2gp-x888-6xrj (Vendor Advisory)
- github.com/Cainor/Calendarinho/commit/15b2393efd69101727d27a4e710880ce46e84d70 (Patch)
- github.com/Cainor/Calendarinho/commit/9a0174bef939565a76cbe7762996ecddca9ba55e (Patch)
- github.com/Cainor/Calendarinho/commit/c77defeb0103c1f7a4709799b8751aaeb0d09eed (Patch)
Frequently asked questions
- What is CVE-2023-49281?
- CVE-2023-49281 is a medium-severity vulnerability in Cainor Calendarinho, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 4.7/10. Published 2023-12-01.
- How severe is CVE-2023-49281?
- Medium severity. CVSS v3 base score is 4.7 out of 10.