CVE-2023-5375: mosparo mosparo/mosparo advisory

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.

Description quoted from the CVE record (assigned by @huntrdev, published 2023-10-04).

Weakness: CWE-601 URL Redirection to Untrusted Site

How it can be exploited

Exploitable over the network with low attack complexity needing no privileges and a user must take an action. Impact: confidentiality none, integrity low, availability none. CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: no. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Also known as: CNNVD-202310-242, EUVD-2023-57691, GHSA-62f9-v4fv-rw5h

VEDAS cluster: VEDAS:CASCADESPIRIT

Exploit Observer links 6 pieces of public exploit code or detection modules that name this CVE or one of its aliases.

Exploit code and modules (6)

Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.

Vulnerability databases and vendor advisories (6)

Catalogue entries, not exploit evidence.

Vulnerability database or vendor advisory: https://euvd.enisa.europa.eu/enisa/EUVD-2023-57691
Vulnerability database or vendor advisory: https://github.com/advisories/GHSA-62f9-v4fv-rw5h
Vulnerability database or vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-5375
Vulnerability database or vendor advisory: https://osv.dev/vulnerability/CVE-2023-5375
Vulnerability database or vendor advisory: https://osv.dev/vulnerability/CVE-2023-5375
Vulnerability database or vendor advisory: https://www.cnnvd.org.cn/home/globalSearch?keyword=CNNVD-202310-242

5 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS: 0.390
likely to be attacked soon
VEDAS: 0.990
strong exploit evidence
On CISA KEV: Not listed
Detection rule: Nuclei · Suricata

Who is affected

Product	Affected	Not affected
mosparo mosparo/mosparo	before 1.0.2	Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

Exploit Observer also maps it to: mosparo mosparo.

How to fix it

Fixed versions stated in the CVE record: 1.0.2.

How to detect it

Nuclei template (active check)

GitHub Repository Mosparo/mosparo - Open Redirect
Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /project/switch/1?targetPath=http://oast.pro); it decides using regex matchers. Severity in the template: medium. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash

nuclei -u https://your-host -t CVE-2023-5375.yaml

Show the template (29 lines)

yaml

id: CVE-2023-5375

info:
  name: "GitHub Repository Mosparo/mosparo - Open Redirect"
  author: vedas-arpsyndicate
  severity: medium
  description: |
    Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2023-5375&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=mosparo&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-5375
    cwe-id: CWE-601
  metadata:
    verified: false
  tags: cve2023,cve,huntr,mosparo,redirect,vuln
http:
  - method: GET
    path:
      - "{{BaseURL}}/project/switch/1?targetPath=http://oast.pro"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)oast\.pro.*$'

CVE-2023-5375.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2023-5375 GitHub Repository Mosparo/mosparo - Open Redirect. Add them to your Suricata rule set and reload.

Show the rules

suricata

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2023-5375 GitHub Repository Mosparo/mosparo - Open Redirect"; flow:established,to_server; http.uri; content:"project"; nocase; content:"=http://"; nocase; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2023-5375; reference:url,https://www.exploit.observer/?keyword=CVE-2023-5375&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=mosparo&match=exact; sid:1002036; rev:2;)

CVE-2023-5375.rules on GitHub

References

Other references

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.