Products

Solutions

Resources

Search for API Security Tests

CVE-2023-26448: Custom log-in and log-out locations are used-defined as jslo..

open-xchange

Aug 2, 2023

Aug 7, 2023

Medium

5.4

/

10

Description

Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker would require temporary access to the users account or lure a user to a compromised account. We now sanitize jslob content for those locations to avoid redirects to malicious content. No publicly available exploits are known.

Products affected:

Are your APIs vulnerable to this CWE?

Are your APIs vulnerable to this CWE?

Are your APIs vulnerable to this CWE?

In a few clicks Akto can analyze your API attack surface and see what APIs are vulnerable to OWASP Top 10 and other common CWEs.

Akto BG image
Akto BG image
Akto BG image

Severity

Medium

Medium

5.4

/

10

CVSS base metrics

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

User interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Exploitability Score

2.3

Impact Score

2.7

Weakness

CWE-79__CWE-79__

Explore more from Akto

Blog

Be updated about everything related to API Security, new API vulnerabilities, industry news and product updates.

Test Library

Discover and find tests from Akto's 100+ API Security test library. Choose your template or add a new template to start your API Security testing.

Documentation

Check out Akto's product documentation for all information related to features and how to use them.