VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
249bc4cebedade5155d8eeefbac7a00eae5d85bc
vuln-cve/data/2026/8xxx/CVE-2026-8152.json
T

249 lines
13 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-8152",
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"state": "PUBLISHED",
"assignerShortName": "NCSC.ch",
"dateReserved": "2026-05-08T08:12:13.325Z",
"datePublished": "2026-07-22T12:21:28.977Z",
"dateUpdated": "2026-07-22T18:55:07.732Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch",
"dateUpdated": "2026-07-22T12:21:28.977Z"
},
"title": "Unblu Spark Open Redirect leading to DOM-Based XSS",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-588",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-588 — DOM-Based XSS"
}
]
}
],
"affected": [
{
"vendor": "Unblu inc.",
"product": "Unblu Spark",
"platforms": [
"On-premises",
"Cloud"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "8.36.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.36.1-hotfix.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.37.0",
"versionType": "semver"
}
],
"defaultStatus": "affected"
}
],
"descriptions": [
{
"lang": "en",
"value": "Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.\n\n\nWhen Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<div><div>Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.</div><br><div>When Unblu Spark is deployed with <code>com.unblu.identifier.siteEmbeddedSetup=true</code>, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.</div></div><p><br></p>"
}
]
}
],
"references": [
{
"url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001",
"name": "Unblu Security Advisories",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "On-premises deployment (same site)"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "CRITICAL",
"baseScore": 9.3,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N"
}
},
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Cloud deployment"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "HIGH",
"baseScore": 7,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"
}
}
],
"workarounds": [
{
"lang": "en",
"value": "If you cannot upgrade immediately, either of the following measures prevents exploitation:\n\n * Enable the built-in Content Security Policy by setting com.unblu.contentsecuritypolicy.mode=on. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. Note: this protection is only effective on Unblu Spark 7.56.2 or later in the 7.x series and 8.19.1 or later in the 8.x series, where unsafe-inline was removed from the script source policy. Earlier versions ship a CSP that still permits unsafe-inline and are not protected by this workaround.\n * Configure a WAF rule to block requests that carry a malicious payload in the redirectOnFailure parameter (in particular, values containing a javascript: scheme or obfuscated variants such as java%0ascript:).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<div>If you cannot upgrade immediately, either of the following measures prevents exploitation:</div><div><ul><li>Enable the built-in Content Security Policy by setting&nbsp;<code>com.unblu.contentsecuritypolicy.mode=on</code>. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. <b>Note:</b>&nbsp;this protection is only effective on Unblu Spark <b>7.56.2 or later</b>&nbsp;in the 7.x series and <b>8.19.1 or later</b>&nbsp;in the 8.x series, where&nbsp;<code>unsafe-inline</code>&nbsp;was removed from the script source policy. Earlier versions ship a CSP that still permits&nbsp;<code>unsafe-inline</code>&nbsp;and are not protected by this workaround.</li><li>Configure a WAF rule to block requests that carry a malicious payload in the&nbsp;<code>redirectOnFailure</code>&nbsp;parameter (in particular, values containing a&nbsp;<code>javascript:</code>&nbsp;scheme or obfuscated variants such as&nbsp;<code>java%0ascript:</code>).</li></ul></div><br><br>"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "In the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter.\n\n\nAfter upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (document.location.origin).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<div>In the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter.</div><br><div>After upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (<code>document.location.origin</code>).</div><div><br></div><br>"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Kenan Karalioglu (chef_shell) via YesWeHack",
"type": "finder"
}
],
"source": {
"advisory": "UBL-2026-001",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "manual"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-07-22T18:54:56.321413Z",
"id": "CVE-2026-8152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-07-22T18:55:07.732Z"
}
}
]
}
}
View Git Blame Copy Permalink