Description
lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix.

Published: 2023-04-24
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-2503 lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix.
Github GHSA Github GHSA GHSA-5fwq-9x7j-2qpg lorawan-stack Open Redirect vulnerability
History

Wed, 05 Feb 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Thethingsnetwork Lorawan-stack
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-02-04T18:47:56.252Z

Reserved: 2023-02-23T23:22:58.577Z

Link: CVE-2023-26494

cve-icon Vulnrichment

Updated: 2024-08-02T11:53:53.583Z

cve-icon NVD

Status : Modified

Published: 2023-04-24T17:15:10.693

Modified: 2024-11-21T07:51:38.097

Link: CVE-2023-26494

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses