CVE-2025-60868
Unknown
Unknown - Not Provided
BaseFortify
Publication date: 2025-10-10
Last updated on: 2025-10-14
Assigner: MITRE
Description
Description
The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter pollution, or denial of service.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| statamic | alt_redirect | 1.6.3 |
| statamic | statamic | * |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-290 | This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can lead to cache poisoning, parameter pollution, or denial of service attacks, potentially disrupting normal application behavior or allowing attackers to manipulate cached content.
Can you explain this vulnerability to me?
The Alt Redirect 1.6.3 addon for Statamic has a flaw where it does not consistently remove query string parameters when the "Query String Strip" feature is enabled. Specifically, variations in case, encoded keys, and duplicate parameters are not stripped out, which allows attackers to bypass the intended sanitization process.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70