CVE-2024-8527 - Vulnerability Details - OpenCVE

Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions.

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Automatedlogic	Webctrl

No data.

No data.

References

Link	Providers
https://www.corporate.carrier.com/product-security/advisories-resources/

History

Fri, 21 Nov 2025 09:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Automatedlogic Automatedlogic webctrl
Vendors & Products		Automatedlogic Automatedlogic webctrl

Wed, 19 Nov 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 19 Nov 2025 13:30:00 +0000

Type	Values Removed	Values Added
Description		Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions.
Title		ALC WebCTRL Carrier i-Vu Open Redirect via URL parameter
Weaknesses		CWE-601
References		https://www.corporate.carrier.com/product-security/advisories-resources/
Metrics		cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L'}`

MITRE

Status: PUBLISHED

Assigner: Carrier

Published: 2025-11-19T13:17:01.911Z

Updated: 2025-11-19T16:05:46.478Z

Reserved: 2024-09-06T16:01:32.884Z

Link: CVE-2024-8527

Vulnrichment

Updated: 2025-11-19T16:04:54.627Z

NVD

Status : Awaiting Analysis

Published: 2025-11-19T14:15:56.953

Modified: 2025-11-19T19:14:59.327

Link: CVE-2024-8527

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-8527", "assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f", "state": "PUBLISHED", "assignerShortName": "Carrier", "dateReserved": "2024-09-06T16:01:32.884Z", "datePublished": "2025-11-19T13:17:01.911Z", "dateUpdated": "2025-11-19T16:05:46.478Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "WebCtrl", "vendor": "Automated Logic", "versions": [{"lessThanOrEqual": "9.0", "status": "affected", "version": "6.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "i-Vu", "vendor": "Carrier", "versions": [{"lessThanOrEqual": "9.0", "status": "affected", "version": "6.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jaryl Low"}, {"lang": "en", "type": "finder", "value": "Thuy D. Nguyen"}, {"lang": "en", "type": "finder", "value": "Cynthia E. Irvine"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions."}], "value": "Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.6, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f", "shortName": "Carrier", "dateUpdated": "2025-11-19T13:17:01.911Z"}, "references": [{"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade to the latest version of ALC WebCTRL or Carrier i-Vu.  \n\n<br>"}], "value": "Upgrade to the latest version of ALC WebCTRL or Carrier i-Vu."}], "source": {"discovery": "UNKNOWN"}, "title": "ALC WebCTRL Carrier i-Vu Open Redirect via URL parameter", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-19T16:04:40.466031Z", "id": "CVE-2024-8527", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T16:05:46.478Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8527", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-19T16:04:40.466031Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T16:04:54.627Z"}}], "cna": {"title": "ALC WebCTRL Carrier i-Vu Open Redirect via URL parameter", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Jaryl Low"}, {"lang": "en", "type": "finder", "value": "Thuy D. Nguyen"}, {"lang": "en", "type": "finder", "value": "Cynthia E. Irvine"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Automated Logic", "product": "WebCtrl", "versions": [{"status": "affected", "version": "6.0", "versionType": "semver", "lessThanOrEqual": "9.0"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "Carrier", "product": "i-Vu", "versions": [{"status": "affected", "version": "6.0", "versionType": "semver", "lessThanOrEqual": "9.0"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to the latest version of ALC WebCTRL or Carrier i-Vu.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to the latest version of ALC WebCTRL or Carrier i-Vu.  \n\n<br>", "base64": false}]}], "references": [{"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions.", "supportingMedia": [{"type": "text/html", "value": "Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f", "shortName": "Carrier", "dateUpdated": "2025-11-19T13:17:01.911Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8527", "state": "PUBLISHED", "dateUpdated": "2025-11-19T16:05:46.478Z", "dateReserved": "2024-09-06T16:01:32.884Z", "assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f", "datePublished": "2025-11-19T13:17:01.911Z", "assignerShortName": "Carrier"}, "dataVersion": "5.2"}