netflix/security_monkey · Security
Netflix Security Monkey Open Redirect vulnerability
- GHSA ID
- GHSA-j6jq-3q8p-xgg6
- CVE ID
- CVE-2017-7266
- Severity
- medium
- Published
- Updated
- CVSS
- 6.1 · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v3
- 6.1 · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.
CWEs
- CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-7266 ↗
- https://github.com/Netflix/security_monkey/pull/482 ↗
- https://github.com/Netflix/security_monkey/commit/3b4da13efabb05970c80f464a50d3c1c12262466 ↗
- https://github.com/Netflix/security_monkey/releases/tag/v0.8.0 ↗
- https://web.archive.org/web/20201220170714/http://www.securityfocus.com/bid/97088 ↗
- https://github.com/advisories/GHSA-j6jq-3q8p-xgg6 ↗