| Package | Affected versions | Patched versions |
|---|---|---|
| xenforo | = 2.3.0< 2.2.17 | 2.2.17 |
XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL. The getDynamicRedirect() function does not adequately validate the redirect target, allowing attackers to redirect users to arbitrary external sites using crafted URLs containing newlines, user credentials, or host mismatches.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free