Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions.

CWE-601 URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Automated Logic WebCTRL and Carrier i-Vu Building Automation System products. The application accepts a user-supplied URL and redirects without proper validation, allowing attackers to exploit user sessions through a combination of open redirect and cross-site scripting to redirect victims to malicious sites.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	Name	Product	Family	Severity
505500	Automated Logic WebCTRL Premium Server URL Redirection to Untrusted Site (CVE-2024-8527)	Tenable OT Security	Tenable.ot	high
505499	Automated Logic WebCTRL Premium Server URL Redirection to Untrusted Site (CVE-2024-8527)	Tenable OT Security	Tenable.ot	high
505498	Automated Logic WebCTRL Premium Server URL Redirection to Untrusted Site (CVE-2024-8527)	Tenable OT Security	Tenable.ot	high

Detections

Analytics

CVE-2024-8527

high

Tenable Plugins

high

high

high