CyberRota Analysis
AI-GeneratedXenForo versions prior to 2.3.13 are vulnerable to a cross-site scripting (XSS) flaw in the dynamic redirect handler, enabling unauthenticated attackers to execute arbitrary JavaScript in the context of the board. This vulnerability can be exploited by crafting a malicious javascript: URI that bypasses host validation, potentially compromising authenticated users' sessions when they follow the malicious link. Organizations using affected versions of XenForo should prioritize patching to mitigate the risk of XSS attacks and protect user data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostname in the URI authority component and use percent-encoded newlines to evade server-side filters, causing authenticated users who perform a Follow action to execute attacker-supplied JavaScript in their browser.
Related CVEs
Other vulnerabilities affecting the same vendor(s)