CVE-2017-18262

Опубликовано: 30 апр. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 5.8

EPSS Низкий

Описание

Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any signed-in user through its endpoints for handling Shibboleth logins, as demonstrated by a webapps/bb-auth-provider-shibboleth-BBLEARN/execute/shibbolethLogin?returnUrl= URI.

Ссылки

http://seclists.org/fulldisclosure/2018/Apr/57
Mailing List
Third Party Advisory
http://www.securitytracker.com/id/1040767
Third Party Advisory
VDB Entry
https://ethan.pm/blackboard.txt
Third Party Advisory
http://seclists.org/fulldisclosure/2018/Apr/57
Mailing List
Third Party Advisory
http://www.securitytracker.com/id/1040767
Third Party Advisory
VDB Entry
https://ethan.pm/blackboard.txt
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:blackboard:blackboard_learn:*:*:*:*:*:*:*:*

Версия до 9.1 (включая)

cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2016:*:*:*:*:*:*

cpe:2.3:a:blackboard:blackboard_learn:9.1:q2_2017:*:*:*:*:*:*

cpe:2.3:a:blackboard:blackboard_learn:9.1:q4_2015:*:*:*:*:*:*

cpe:2.3:a:blackboard:blackboard_learn:9.1:q4_2016:*:*:*:*:*:*

cpe:2.3:a:blackboard:blackboard_learn:9.1:q4_2017:*:*:*:*:*:*

EPSS

Процентиль: 51%

0.00278

Низкий

6.1 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

GHSA-946w-mjq8-xx28