CVE-2019-11016: Elgg open redirect
Summary
CVE-2019-11016: Elgg open redirect. Affects elgg/elgg across 2 version ranges.
< 1.12.18
>= 2.3.0, < 2.3.11
Fixed in 1.12.18 or 2.3.11, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Elgg is an open-source social networking engine that allows users to create and manage their own social networks. It provides various features such as user profiles, activity streams, and content sharing. However, versions before 1.12.18 and 2.3.x before 2.3.11 of Elgg are vulnerable to an open redirect attack.
Vulnerability Detail
The open redirect vulnerability in Elgg allows an attacker to craft a malicious URL that redirects users to a different website. This can be exploited to trick users into visiting a malicious site, potentially leading to phishing attacks or the execution of arbitrary code. The vulnerability is rated as moderate with a CVSS score of 6.1.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.12.181.12.18composer require elgg/elgg:1.12.18 -
>= 2.3.0, < 2.3.112.3.11composer require elgg/elgg:2.3.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating to the latest version of Elgg.
Conclusion
The open redirect vulnerability in Elgg can be mitigated by updating to the latest version of the software. It is crucial to apply the recommended fix to protect users from potential phishing attacks or the execution of arbitrary code. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for elgg/elgg →
FAQ
An open redirect vulnerability allows an attacker to redirect users to a different website, potentially leading to phishing attacks or the execution of arbitrary code.
The open redirect vulnerability in Elgg can be exploited to trick users into visiting a malicious site, which can result in various attacks such as phishing or the execution of arbitrary code.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Elgg installation is affected by this vulnerability. Simply provide your composer.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, patches are available to fix this vulnerability. It is recommended to update to the latest version of Elgg, which includes the necessary patches.
You can find more information about this vulnerability in the GitHub Advisory Database. The link to the advisory for this vulnerability is provided in the 'database_specific' field of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for elgg/elgg.
