CVE-2022-31040

Open Forms is an application for creating and publishing smart forms. Prior to versions 1.0.9 and 1.1.1, the cookie consent page in Open Forms contains an open redirect by injecting a `referer` querystring parameter and failing to validate the value. A malicious actor is able to redirect users to a website under their control, opening them up for phishing attacks. The redirect is initiated by the open forms backend which is a legimate page, making it less obvious to end users they are being redirected to a malicious website. Versions 1.0.9 and 1.1.1 contain patches for this issue. There are no known workarounds avaialble.

• CWE-601
• CWE-601

• https://github.com/open-formulieren/open-forms/commit/3e8c9cce386e548765783354694fbb9d7a6ea7d3Patch, Third Party Advisory
• https://github.com/open-formulieren/open-forms/security/advisories/GHSA-c97h-m5qf-j8mfThird Party Advisory
• https://github.com/open-formulieren/open-forms/commit/3e8c9cce386e548765783354694fbb9d7a6ea7d3Patch, Third Party Advisory
• https://github.com/open-formulieren/open-forms/security/advisories/GHSA-c97h-m5qf-j8mfThird Party Advisory

Published

Jun 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31035Argo CD is a declarative, GitOps continuous delivery tool fo…5.4
• CVE-2022-31036Argo CD is a declarative, GitOps continuous delivery tool fo…4.3
• CVE-2022-31037OroCommerce is an open-source Business to Business Commerce …5.4
• CVE-2022-31038Gogs is an open source self-hosted Git service. In versions …5.4
• CVE-2022-31039Greenlight is a simple front-end interface for your BigBlueB…5.3
• CVE-2022-3104An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31041Open Forms is an application for creating and publishing sma…6.5
• CVE-2022-31042Guzzle is an open source PHP HTTP client. In affected versio…7.5
• CVE-2022-31043Guzzle is an open source PHP HTTP client. In affected versio…7.5
• CVE-2022-31044Rundeck is an open source automation service with a web cons…7.5
• CVE-2022-31045Istio is an open platform to connect, manage, and secure mic…9.8
• CVE-2022-31046TYPO3 is an open source web content management system. Prior…4.3