CVE-2011-5252
Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x before 1.3.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 11.9%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x before 1.3.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the ReturnUrl parameter.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
- EPSS
- 11.93% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- orchardproject/orchard
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0023.htmlExploit
- http://orchard.codeplex.com/discussions/283667
- http://secunia.com/advisories/47398Vendor Advisory
- http://www.mavitunasecurity.com/open-redirection-vulnerability-in-orchard/Exploit
- http://www.securityfocus.com/bid/51260Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72110
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0023.htmlExploit
- http://orchard.codeplex.com/discussions/283667
- http://secunia.com/advisories/47398Vendor Advisory
- http://www.mavitunasecurity.com/open-redirection-vulnerability-in-orchard/Exploit
- http://www.securityfocus.com/bid/51260Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72110
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.