Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2017-7266

Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.

VectorNETWORK

PublishedMar 26, 2017, 05:59

Published Bycve@mitre.org

Base Score

Score6.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

security_monkey(PyPI)00.8.0N/A

References

http://www.securityfocus.com/bid/97088
https://github.com/Netflix/security_monkey/commit/3b4da13efabb05970c80f464a50d3c1c12262466
https://github.com/Netflix/security_monkey/pull/482
https://github.com/Netflix/security_monkey/releases/tag/v0.8.0

Weakness Type

CWE-601

CVSS Metrics

Base Score

6.1

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.0

Attack Vector (AV)

NETWORK