CVE-2019-6009

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Open redirect vulnerability in SHIRASAGI v1.7.0 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
SHIRASAGI Project	SHIRASAGI	v1.7.0 and earlier

References

http://jvn.jp/en/jp/JVN74699196/index.htmlThird Party Advisory
https://github.com/shirasagi/shirasagiThird Party Advisory
https://github.com/shirasagi/shirasagi/commit/6016948ea535e51b16535888af13df064a1a15d3Patch, Third Party Advisory
https://github.com/shirasagi/shirasagi/commit/6016948ea535e51b16535888af13df064a1a15d3.patchPatch, Third Party Advisory
https://www.ss-proj.org/Release Notes, Vendor Advisory
http://jvn.jp/en/jp/JVN74699196/index.htmlThird Party Advisory
https://github.com/shirasagi/shirasagiThird Party Advisory
https://github.com/shirasagi/shirasagi/commit/6016948ea535e51b16535888af13df064a1a15d3Patch, Third Party Advisory
https://github.com/shirasagi/shirasagi/commit/6016948ea535e51b16535888af13df064a1a15d3.patchPatch, Third Party Advisory
https://www.ss-proj.org/Release Notes, Vendor Advisory

Timeline

Published: Sep 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-60107.8Integer overflow vulnerability in LINE(Android) from 4.4.0 to the version before 9.15.1 allows remote attackers to cause a denial of service CVE-2019-60116.1Cross-site scripting vulnerability in wpDataTables Lite Version 2.0.11 and earlier allows remote attackers to inject arbitrary web script or CVE-2019-60127.2SQL injection vulnerability in the wpDataTables Lite Version 2.0.11 and earlier allows remote authenticated attackers to execute arbitrary S CVE-2019-60136.6DBA-1510P firmware 1.70b009 and earlier allows authenticated attackers to execute arbitrary OS commands via Command Line Interface (CLI).CVE-2019-60148.8DBA-1510P firmware 1.70b009 and earlier allows an attacker to execute arbitrary OS commands via Web User Interface.CVE-2019-60157.5FON2601E-SE, FON2601E-RE, FON2601E-FSW-S, and FON2601E-FSW-B with firmware versions 1.1.7 and earlier contain an issue where they may behave CVE-2019-60166.1Cross-site scripting vulnerability in REMISE Payment Module (2.11, 2.12 and 2.13) version 3.0.12 and earlier allows remote attackers to inje CVE-2019-60175.3REMISE Payment Module (2.11, 2.12 and 2.13) version 3.0.12 and earlier allow remote attackers to [Disclosed_Information_type] via unspecifie CVE-2019-60186.1Cross-site scripting vulnerability in NetCommons 3.2.2 and earlier (NetCommons3.x) allows remote attackers to inject arbitrary web script or CVE-2019-60197.8Untrusted search path vulnerability in STAMP Workbench installer all versions allows an attacker to gain privileges via a Trojan horse DLL i CVE-2019-60206.1Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.CVE-2019-60216.1Open redirect vulnerability in Library Information Management System LIMEDIO all versions allows remote attackers to redirect users to arbit