Read the docs
TI-2016-06884 Aliases CVE-2016-8376GHSA-6jj9-r558-4xvv

Open redirect in Kabona AB WDC Vulnerabilities prior to Version 3.4.0

Priority LOW 29CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-601.

Summary

An issue was discovered in Kabona AB WebDatorCentral (WDC) application prior to Version 3.4.0. This non-validated redirect/non-validated forward (OPEN REDIRECT) allows chaining with authenticated vulnerabilities.

Why it matters now

EPSS 0.01074 65th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Kabona AB WDC Vulnerabilities prior to Version 3.4.0Kabona AB WDC Vulnerabilities prior to Version 3.4.0—No fix listedCNA
  • Kabona AB WDC Vulnerabilities prior to Version 3.4.0 Vendor— Affected Kabona AB WDC Vulnerabilities prior to Version 3.4.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kabona_ab:webdatorcentral:-:*:*:*:*:*:*:*not specified by NVDVulnerableKabona Ab
  • cpe:2.3:a:kabona_ab:webdatorcentral:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Kabona Ab

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-8376
  2. 2026-10-03 Alias added: GHSA-6jj9-r558-4xvv

References

Advisory 1

  • TI-2016-06858 Improper authentication in Kabona AB WDC prior to Version 3.4.0 CVSS 3.0CRITICAL 9.8
  • TI-2016-06865 Cross-site scripting in Kabona AB WDC prior to Version 3.4.0 CVSS 3.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences