CVE-2022-25799: cert vince Open Redirect
Vulnerability summary
CVE-2022-25799 is a medium (CVSS 6.1) Open Redirect vulnerability in cert vince. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 47.1% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 16-08-2022PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has a specially crafted URL and convince the user to click the link. When an authenticated user clicks the link, the authenticated user's browser could be redirected to a malicious site that is designed to impersonate a legitimate website. The attacker could trick the user and potentially acquire sensitive information such as the user's credentials.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
+0.01 pp
From 0.57% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (cheatsheetseries.owasp.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Cert1 product
- vince< 1.50.0
Cert/cc1 product
- vince - the vulnerability information and coordination environment≥ 1.50.0, < 1.50.0
2 vendors · 2 products
References
2 links- cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.htmlExploitThird Party Advisory