Threats tagged 'ghsa-h3gw-4f62-3cfh'

An open redirect vulnerability exists in Dianping CAT versions 3.0.0, 3.1.0, and 4.0-RC1 in the Handler.redirect function of Handler.java within the Login/Logout component. Manipulating the rtnUrl argument can redirect users to arbitrary URLs. The vulnerability can be exploited remotely and exploit code has been published. The vendor has not responded to disclosure attempts.