CVEvulnerability
CVE-2017-7266
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-03-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-601
Description
Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.
Affected configurations
• netflix security monkey (<= 0.7.0)
Related
Weakness · CWE (1)
- CWE-601 URL Redirection to Untrusted Site weakness
References
- http://www.securityfocus.com/bid/97088 www.securityfocus.com
- https://github.com/Netflix/security_monkey/commit/3b4da13efabb05970c80f464a50d3c1c12262466 Patch, Third Party Advisory
- https://github.com/Netflix/security_monkey/pull/482 Third Party Advisory
- https://github.com/Netflix/security_monkey/releases/tag/v0.8.0 Release Notes, Third Party Advisory
- http://www.securityfocus.com/bid/97088 www.securityfocus.com
- https://github.com/Netflix/security_monkey/commit/3b4da13efabb05970c80f464a50d3c1c12262466 Patch, Third Party Advisory
- https://github.com/Netflix/security_monkey/pull/482 Third Party Advisory
- https://github.com/Netflix/security_monkey/releases/tag/v0.8.0 Release Notes, Third Party Advisory