CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal.
Explanation of Vulnerability in Simple Terms
The Helix Ultimate extension for Joomla contains an open redirect vulnerability that allows an attacker to redirect users to an external website. An attacker can craft a malicious link that, when clicked by a site visitor, redirects them to a phishing or malware site. This could be used to steal credentials or distribute malware to your site's users.
What an attacker can do
Redirect site visitors to an external malicious website via a crafted link.
Potential impact on your site
Your site could be used to phish credentials or distribute malware to visitors who click attacker-crafted links.
Conditions required to exploit
A site visitor must click a malicious link containing the redirect parameter.
Key dates
External resources
Related vulnerabilities
