CVE-2015-3898

Опубликовано: 28 фев. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 5.8

EPSS Низкий

Описание

Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the redirectUrl parameter to (1) bonita/login.jsp or (2) bonita/loginservice.

Ссылки

http://packetstormsecurity.com/files/132237/Bonita-BPM-6.5.1-Directory-Traversal-Open-Redirect.html
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/535733/100/0/threaded
Exploit
Third Party Advisory
VDB Entry
https://www.htbridge.com/advisory/HTB23259
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/132237/Bonita-BPM-6.5.1-Directory-Traversal-Open-Redirect.html
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/535733/100/0/threaded
Exploit
Third Party Advisory
VDB Entry
https://www.htbridge.com/advisory/HTB23259
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:bonitasoft:bonita_bpm_portal:*:*:*:*:*:*:*:*

Версия до 6.5.3 (исключая)

EPSS

Процентиль: 87%

0.03409

Низкий

6.1 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-601

Связанные уязвимости

GHSA-j8pp-wrgj-gr4p