Read the docs
TI-2023-26917 Aliases CVE-2023-49281

Open Redirect in Login Function of Calendarinho

Priority LOW 28CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-601.

Summary

Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites, potentially leading to information theft and reputational damage to the website used for redirection. The problem is has been patched in commit `15b2393`. Users are advised to update to a commit after `15b2393`. There are no known workarounds for this vulnerability.

Why it matters now

EPSS 0.00557 46th percentileScored 2026-11-07
Fix Fixed Calendarinho (Cainor): 15b2393

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CainorCalendarinhobefore 15b239315b2393Patch availableCNA
  • Calendarinho VendorCainor Affected before 15b2393 Fixed in 15b2393 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cainor:calendarinho:*:*:*:*:*:*:*:*before 2023-10-11VulnerableCainor
  • cpe:2.3:a:cainor:calendarinho:*:*:*:*:*:*:*:* Versions before 2023-10-11 Vulnerable ·Cainor

Remediation

  • Fix · CNA Calendarinho (Cainor) Fixed in 15b2393

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49281

References

Patch 3

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences