{"cve":"CVE-2018-1000671","nvd":{"published":"2018-09-06T18:29:00.270","modified":"2026-06-17T01:33:04.020","status":"Modified","description":"sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The \"referer\" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-601"],"references":["https://github.com/sympa-community/sympa/issues/268","https://lists.debian.org/debian-lts-announce/2018/09/msg00023.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00015.html","https://usn.ubuntu.com/4442-1/","https://github.com/sympa-community/sympa/issues/268"],"products":["debian:debian_linux","sympa:sympa"],"source":"nvd","synced_at":"2026-10-19T20:53:14.491561039+00:00"},"epss":{"cve":"CVE-2018-1000671","score":0.03437,"percentile":0.88964,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}