CVE-2023-33405.yaml

http/cves/2023/CVE-2023-33405.yaml

@@ -0,0 +1,35 @@
+id: CVE-2023-33405
+
+info:
+  name: BlogEngine CMS - Open Redirect
+  author: Shankar Acharya
+  severity: medium
+  description: |
+    Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect
+  reference:
+    - https://github.com/hacip/CVE-2023-33405
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-33405
+  remediation: |
+    Update to the latest version of blogengine.net CMS  to fix the open redirect vulnerability.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/Au:N/C:N/I:P/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2023-33405
+    cwe-id: CWE-601
+  metadata:
+    max-request: 1
+    product: blogengine_cms
+    vendor: blogengine
+    verified: true
+  tags: cve,cve2023,Blogengine,cms,redirect
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/default.aspx?years=http://oast.pro"
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)oast\.pro.*$'
+        part: header

http/exposures/tokens/twilio/twilio-api-key.yaml

@@ -20,4 +20,4 @@ http:
       - type: regex
         part: body
         regex:
-          - '(?i)twilio.{0,20}\b(sk[a-f0-9]{32})\b'
+          - '(?i)twilio.{0,20}\b(sk[a-f0-9]{32})\b'