GitHub Advisoryadvisory · PyPI
GHSA-j6jq-3q8p-xgg6 Netflix Security Monkey Open Redirect vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2017-7266
- Ecosystem
- PyPI
- Packages
- security_monkey
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-601
- Reviewed
- 2024-04-08
Affected packages
• PyPI security_monkey: < 0.8.0 → fixed in 0.8.0
Description
Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.
Related
Alias · CVE (1)
- CVE-2017-7266 Netflix Security Monkey before 0.8.0 has an Open Redirect. vulnerability
Weakness · CWE (1)
- CWE-601 URL Redirection to Untrusted Site weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-7266 advisory
- https://github.com/Netflix/security_monkey/pull/482 web
- https://github.com/Netflix/security_monkey/commit/3b4da13efabb05970c80f464a50d3c1c12262466 web
- https://github.com/Netflix/security_monkey package
- https://github.com/Netflix/security_monkey/releases/tag/v0.8.0 web
- https://web.archive.org/web/20201220170714/http://www.securityfocus.com/bid/97088 web