CVE-2026-46688: meeting-room-booking-system mrbs-code, пренасочване

Описание

Оригинално описание

The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that will cause the user who clicks it to be redirected to the attacker-specified redirect URL, which could be a spoofed MRBS login page, for example. Version 1.12.2 contains a fix. No known workarounds are available.

Засегнати продукти

• meeting-room-booking-system mrbs-code: < 1.12.2

Вид слабост

• CWE-601 URL Redirection to Untrusted Site

История

Други уязвимости в meeting-room-booking-system mrbs-code

• 8.7CVE-2026-46382

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-46688
• https://nvd.nist.gov/vuln/detail/CVE-2026-46688
• https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-6xcj-g522-859f
• https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.12.2