CVE-2021-24288

CVE-2021-24288: AcyMailing < 7.5.0 - Unauthenticated Open Redirect

Vendor Acymailing
Product Newsletter via SMTP, Sendinblue, Sendgrid, Mailgun - AcyMailing SMTP Newsletter
Weakness CWE-601 · Open redirect
Published May 17, 2021
Last update August 3, 2024

CVSS base score

What the vulnerability does

01Description

When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim.

Key dates

02Disclosure timeline

May 17, 2021 CVE published
August 3, 2024 Record updated