VulnerabilityModified
CVE-2014-2213
Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to portal/scr_sendmd5.php.
MEDIUM 6.1EPSS 1.44%
Does this matter?
Lower severity and a low EPSS score (1.44%). Track it; it rarely justifies an emergency change on its own.
Description
Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to portal/scr_sendmd5.php.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.44% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-601
- Affected
- posh project/posh
- Source
- cve@mitre.org
References
- http://seclists.org/oss-sec/2014/q1/444Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/65843Third Party Advisory, VDB Entry
- https://sysdream.com/news/lab/posh-3-2-1-multiple-vulnerabilities/Exploit, Third Party Advisory
- http://seclists.org/oss-sec/2014/q1/444Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/65843Third Party Advisory, VDB Entry
- https://sysdream.com/news/lab/posh-3-2-1-multiple-vulnerabilities/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.