TI-2022-09370 Aliases CVE-2022-25799 GHSA-wjw7-pcj2-4prm

An open redirect vulnerability exists in CERT/CC VINCE software prior to version 1.50.0

LOW 28CWE-601Published 2022-08-16 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-601.

Summary

An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has a specially crafted URL and convince the user to click the link. When an authenticated user clicks the link, the authenticated user's browser could be redirected to a malicious site that is designed to impersonate a legitimate website. The attacker could trick the user and potentially acquire sensitive information such as the user's credentials.

Why it matters now

EPSS 0.00602 49th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed VINCE - The Vulnerability Information and Coordination Environment (CERT/CC): 1.50.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
CERT/CC	VINCE - The Vulnerability Information and Coordination Environment	1.50.0 to before 1.50.0	1.50.0	Patch available	CNA

VINCE - The Vulnerability Information and Coordination Environment VendorCERT/CC Affected 1.50.0 to before 1.50.0 Fixed in 1.50.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cert:vince::::::::	before 1.50.0	Vulnerable	CERT/CC

cpe:2.3:a:cert:vince:*:*:*:*:*:*:*:* Versions before 1.50.0 Vulnerable ·CERT/CC

Remediation

Fix · CNA VINCE - The Vulnerability Information and Coordination Environment (CERT/CC) Fixed in 1.50.0

Timeline

2026-10-02 Threatist record created from CVE-2022-25799
2026-10-03 Alias added: GHSA-wjw7-pcj2-4prm

References

Exploit 1

https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html

Advisory 1

https://github.com/CERTCC/VINCE/issues/45

TI-2022-19099 Deserialization of untrusted data in CERT/CC VINCE - The Vulnerability Information and… CVSS 3.1HIGH 8.8
TI-2024-09697 CERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view. CVSS 3.1MEDIUM 6.5
TI-2022-19104 An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4 CVSS 3.1MEDIUM 5.4
TI-2022-19102 An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4 CVSS 3.1MEDIUM 5.4
TI-2024-09236 Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8 CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences