CVE-2023-5375

Mosparo is a tool websites use to tell humans apart from spam bots, similar to a CAPTCHA. This flaw is like a signpost at your business entrance that a stranger could quietly swap so visitors following a trusted link end up somewhere else entirely — a fake site designed to steal their information. The attacker needs the visitor to click a specially crafted link first.

This matters to you if you run mosparo (the spam/bot-protection service) on your website, version 1.0.2 or earlier. It only becomes a real risk if someone can get your users to click a manipulated link pointing at your mosparo installation — it doesn't happen automatically just by visiting your site.

There's a known, publicly available exploit for this flaw, and it has drawn sustained press attention, but there's no confirmed evidence of attackers actively exploiting it in the wild and it isn't on any government list of actively-attacked vulnerabilities. Treat this as a real issue to fix in your normal patch cycle, not a drop-everything emergency.

Confirm exposure by checking your deployed mosparo version (composer.lock or application version endpoint) against 1.0.2. If below 1.0.2, upgrade directly to 1.0.2 or later — review the vendor's patch commit (https://github.com/mosparo/mosparo/commit/9d5da367b78b8c883bfef5f332ffea26292f99e8) to understand the exact redirect-parameter validation that was added, in case you have custom forks or wrappers that need equivalent fixes. No CISA KEV due date applies since this CVE is not in the KEV catalog. As a temporary mitigation if you can't patch immediately, add a reverse-proxy or WAF rule that validates/rejects redirect parameters pointing outside your allow-listed domains. Monitor for phishing campaigns referencing your domain and watch EPSS/exploitation feeds for this CVE in case activity escalates (EPSS trend is currently falling).

CVSS 6.1 (Medium), vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N — network-exploitable, no privileges required, but requires user interaction (clicking a link), with limited confidentiality/integrity impact and a scope change (redirect target off-site). Weakness is CWE-601 (Open Redirect), triggered via an unvalidated redirect parameter. A public exploit/PoC exists, raising exploit maturity to 'functional PoC' rather than theoretical. Not listed in CISA KEV and no confirmed in-the-wild exploitation reported; EPSS places predicted exploitation likelihood in a notably high percentile with a falling trend, consistent with elevated-but-unconfirmed risk. Fixed in 1.0.2 per vendor commit.