CVE-2023-32517: 
NixOS vulnerability analysis and mitigation

URL Redirection to Untrusted Site ('Open Redirect') vulnerability was discovered in PluginOps MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder affecting versions through 4.0.9.3. The vulnerability was reported on March 30, 2023, and published on December 29, 2023 (Patchstack).

The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site) with a CVSS v3.1 base score of 6.1 (Medium) according to NIST (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Patchstack assigned a slightly lower CVSS score of 4.7 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N (NVD).

The vulnerability could allow a malicious actor to redirect users from one site to another due to the redirect URL not being validated. Users could be tricked into visiting a legitimate site only to be redirected to a malicious site, potentially leading to phishing incidents (Patchstack).

Users are advised to update to version 4.0.9.4 or later to remove the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users update to a fixed version (Patchstack).