CVE-2024-58342 - CVE House
Back to Database
Status published Medium CVE-2024-58342

XenForo Open Redirect via getDynamicRedirect

Vulnerability Description

XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL. The getDynamicRedirect() function does not adequately validate the redirect target, allowing attackers to redirect users to arbitrary external sites using crafted URLs containing newlines, user credentials, or host mismatches.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-58342

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • mattrogowski
  • Jake B.
  • ThemeHouse

References

More from XenForo

View All →
CVE-2025-71282
XenForo Path Disclosure via open_basedir Exceptions
High 8.7
CVE-2025-71281
XenForo Template Method Call Restriction Bypass
High 8.7
CVE-2025-71280
XenForo Local Account Page Caching Information Disclosure
Medium 6.9
CVE-2025-71279
XenForo Passkey Security Bypass
Critical 9.3
CVE-2025-71278
XenForo OAuth2 Unauthorized Scope Request
High 8.7

Affected Vendor

Affected Software

XenForo
Vulnerable Versions:
0, 2.3.0

Timeline

Official Publish: April 1st, 2026
Last Modified: April 1st, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-601

MITRE ATT&CK TTPs

T1566 Phishing
Initial Access
T1204 User Execution
Execution
T1071 Application Layer Protocol
Command and Control
T1189 Drive-by Compromise
Initial Access
T1036 Masquerading
Defense Evasion