PatchTheCVEredirection vulnerabilities and fixes
Recent CVEs affecting redirection, with upgrade or downgrade steps. 8 tracked.
redirection has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2023-07-28. Highest priority: CVE-2018-1000509 (score 51/100).
- CVE-2023-3977 MEDIUM 4.3 UPGRADE UPGRADE Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installat
- CVE-2023-1331 MEDIUM 6.5 UPGRADE The Redirection WordPress plugin before 1.1.5 does not have CSRF checks in the uninstall action, which could a
- CVE-2023-1330 MEDIUM 6.5 UPGRADE The Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirec
- CVE-2023-0958 MEDIUM 4.3 UPGRADE UPGRADE Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missin
- CVE-2018-1000509 HIGH 7.2 DOWNGRADE Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settin
- CVE-2018-1000504 HIGH 7.2 DOWNGRADE Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result
- CVE-2012-6717 MEDIUM 6.1 UPGRADE The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.
- CVE-2011-5329 MEDIUM 6.1 UPGRADE The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4
FAQ
How do I fix redirection vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is redirection being exploited right now?
None of the tracked redirection CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which redirection CVE should I patch first?
CVE-2018-1000509 currently ranks highest (51/100): Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settin.