bitly vulnerabilities

Products

• Bitly 2
• github.com/bitly/oauth2_proxy 2

Latest bitly CVEs

Newest publication first

1. CVE-2024-43209 WordPress Bitly's WordPress Plugin plugin <= 2.7.2 - Broken Access Control vulnerability

   Published 2024-11-01

   Medium·CVSS 6.5

   Missing Authorization vulnerability in Bitly allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bitly: from n/a through 2.7.2.

2. CVE-2023-5577 Bitly's WordPress Plugin <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

   Published 2023-11-07

   Medium·CVSS 5.4

   The Bitly's plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpbitly' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authen...

3. CVE-2017-1000069 Cross-site Request Forgery (CSRF)

   Published 2017-07-13

   High·CVSS 8.8

   CSRF in Bitly oauth2_proxy 2.1 during authentication flow

4. CVE-2017-1000070 Open Redirect in oauth2_proxy

   Published 2017-07-13

   Medium·CVSS 6.1

   The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow. This issue was caused by improper input validation and a violation of RFC-6819

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.