CVE-2024-55452 is a medium severity URL redirection vulnerability identified in UJCMS version 9.6.3. The root cause is insufficient validation of URLs during the upload and rendering process of new block or carousel items within the CMS. This flaw allows an authenticated attacker with privileges to create or modify these UI components to embed malicious URLs that redirect unprivileged users to arbitrary, attacker-controlled domains. The attack vector requires the attacker to be authenticated (PR:L) and the victim user to interact by clicking the malicious block item (UI:R). The vulnerability impacts confidentiality and integrity by enabling theft of sensitive tokens such as JSON Web Tokens via crafted external webpages. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates network attack vector, low attack complexity, privileges required, user interaction needed, scope changed, and partial confidentiality and integrity impact without availability impact. No patches or known exploits are currently reported. This vulnerability falls under CWE-601 (URL Redirection to Untrusted Site).

The primary impact of CVE-2024-55452 is the potential compromise of user session tokens and other sensitive information through redirection to malicious sites. This can lead to unauthorized access to user accounts if tokens like JSON Web Tokens are stolen and reused by attackers. The vulnerability undermines user trust and can facilitate further attacks such as phishing or session hijacking. Since exploitation requires authentication and user interaction, the risk is somewhat limited to environments where attackers have some level of access and users may be tricked into clicking malicious UI elements. However, in organizations using UJCMS 9.6.3 for internal or external web content management, this vulnerability could be leveraged to escalate attacks or breach confidentiality. The lack of availability impact means service disruption is unlikely, but data confidentiality and integrity are at risk.

To mitigate CVE-2024-55452, organizations should implement strict validation and sanitization of URLs uploaded or embedded in block and carousel items within UJCMS. Restrict the ability to create or modify these UI components to highly trusted and authenticated users only. Employ Content Security Policy (CSP) headers to limit the domains to which users can be redirected or from which scripts can be loaded. Monitor and audit changes to block and carousel items for suspicious URLs. Educate users to be cautious when clicking on newly added or unfamiliar UI elements. If possible, disable or limit the use of blocks/carousels that allow URL embedding until a patch is available. Regularly check for updates from UJCMS vendors and apply security patches promptly once released. Consider implementing multi-factor authentication to reduce the risk of attacker authentication.